C. DEPARTMENTS' INCREASING AWARENESS AND AUDIT OF PERSONAL DATA PROTECTION AND PROCESSING
Emin Cable ensures the organization of necessary awareness trainings for its employees and authorized sales points to prevent the unlawful processing of personal data, prevent unauthorized access to data, and ensure the preservation of data.
D. INCREASING AWARENESS AND AUDIT OF PERSONAL DATA PROTECTION AND PROCESSING FOR BUSINESS PARTNERS AND SUPPLIERS
Emin Cable ensures the organization of necessary trainings for its business partners and suppliers to increase awareness about preventing the unlawful processing of personal data, preventing unauthorized access to data, and ensuring the preservation of data.
III. PRINCIPLES AND RULES TO BE FOLLOWED IN THE PROCESSING OF PERSONAL DATA
A. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES ENVISAGED IN LEGISLATION
Processing in Compliance with Law and Integrity
Personal data within Emin Cable are processed in accordance with the principles of integrity, transparency, and the obligation to inform of the relevant individuals.
Ensuring Personal Data is Accurate and Up-to-Date
Necessary measures are taken in data processing procedures to ensure that the processed data is accurate and up-to-date. The individuals concerned are provided with the opportunity to update their data and to correct any errors in the processed data, if any.
Processing for Specified, Explicit, and Legitimate Purposes
Personal data processed by Emin Cable are processed within the framework of legitimate purposes defined clearly and explicitly, including compliance with legislation and the ordinary course of commercial life.
Relevant, Limited, and Proportional Processing to the Purpose of Processing
Personal data is processed in a relevant, limited, and proportionate manner to the purposes clearly defined. Processing of irrelevant or unnecessary personal data is avoided. Therefore, unless legally required, we do not process or process sensitive personal data and obtain explicit consent with regard to the subject when it is necessary to process them.
Retention of Personal Data for the Purpose of Processing or as Required by the Relevant Legislation
Many regulations in legislation require personal data to be retained for a certain period. Therefore, the processed personal data is stored for the period prescribed in the relevant legislation or as long as necessary for the purpose of processing personal data.
Upon expiration of the prescribed retention periods or the cessation of the purpose of processing, personal data is deleted, destroyed, or anonymized. The principles and periods of retention are explained in detail in article IV. C. of this policy.
B. PROCESSING OF PERSONAL DATA LIMITED TO THE PERSONAL DATA PROCESSING CONDITIONS SPECIFIED IN ARTICLE 5 OF THE LAW ON THE PROTECTION OF PERSONAL DATA (KVKK)
Personal data is processed only within the scope of the personal data processing conditions specified in Article 5 of the KVKK; as expressly provided for by laws, where it is mandatory for the protection of life or physical integrity of the data subject or another person who is unable to express their consent due to actual impossibility or whose consent is not legally valid, provided that it is directly related to the establishment or performance of a contract and is necessary for the data controller to fulfill its legal obligation, without the need for the data subject's consent, provided that it has been made public by the data subject himself/herself, where processing is necessary for the establishment, exercise, or protection of a right, provided that it does not harm the fundamental rights and freedoms of the data subject, and where processing is necessary for the legitimate interests pursued by the data controller, limited to these purposes and conditions.
C. INFORMING AND ENLIGHTENING THE DATA SUBJECT
During the collection of personal data by Emin Cable, the relevant individuals are first informed and enlightened in accordance with Article 10 of the KVKK and the Regulation on the Procedures and Principles to be Observed in Fulfilling the Obligation to Inform. Our information texts include;
The company's name, address, and contact information,
If available, information regarding the representative identity,
Categories of personal data,
The purpose for which personal data will be processed,
To whom and for what purpose the processed personal data may be transferred,
The method and legal reason for collecting data,
Rights of the data subject listed in Article 11 of the KVKK, along with their contents. In addition to the above information, application methods are also included in our information texts. Through these methods, transparency and accessibility in the protection of personal data are aimed to be achieved.
As a company, care is taken to ensure that this Policy, which is publicly available, is clear, understandable, and easily accessible to the public.
In addition, employees, job applicants, visitors, customers, and the privacy notices regarding camera systems can be reviewed on the website (www.emincable.com/Corporate/GDPR).
D. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
Special categories of personal data are limitedly specified by laws. In order to process these data, administrative and technical measures are taken to ensure the protection of data in accordance with the provisions of the law and the administrative and technical measures specified by the DPA. Within this scope, processing of special categories of personal data (race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal record, and security measures-related data as well as biometric and genetic data) without explicit consent of the data subject is prohibited by law. Except for health and sexual life-related personal data, personal data specified in the law may be processed without the explicit consent of the data subject. Personal data related to health and sexual life may only be processed without the explicit consent of the data subject by persons or institutions subject to confidentiality obligation or by authorized boards and institutions for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment, and care services, planning and managing health services and financing, provided that it is under the confidentiality obligation.
IV. CLASSIFICATION, PURPOSES OF PROCESSING, AND RETENTION PERIODS OF PERSONAL DATA PROCESSED BY EMİN CABLE
A. CLASSIFICATION OF PERSONAL DATA
Personal Data
Personal data; any kind of information related to an identified or identifiable natural person.
Protection of personal data is only related to natural persons, and information not containing information about a natural person belonging to legal persons is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal persons.
Special Categories of Personal Data
Information about individuals' race, ethnicity, political opinion, philosophical belief, religion, sect, or other beliefs, and their clothing, association, foundation, or union membership, health, sexual life, criminal conviction, and security measures as well as biometric and genetic data.
B. PURPOSES OF PROCESSING PERSONAL DATA
Personal data is processed by Emin Cable in accordance with the requirements of processing specified in the legislation, by taking into account the fundamental principles of data processing.
The purposes of processing personal data by Emin Cable are as follows;
Legally ensuring Emin Cable's human resources policies,
Establishment and execution of commercial activities,
Planning and execution of corporate communication activities,
Making job applications,
Execution of the contract,
Management of customer relations,
Ensuring security, making camera recordings, and monitoring entrance-exit transactions,
Realization of marketing and sales activities,
Assurance of physical space and information security
Ensuring legal, technical, and commercial-business security of Emin Cable and business partners and suppliers,
Ensuring the fulfillment of legal obligations related to Emin Cable, business partners, and suppliers,
Preparation and execution of Emin Cable's and business partners' and suppliers' operational activities,
Execution of financial, accounting, and auditing activities,
Preparation and implementation of Emin Cable's and business partners' and suppliers' commercial and business strategies,
Organization of trainings,
Ensuring corporate sustainability,
Preparation and storage of Emin Cable's and business partners' and suppliers' operational, financial, and other records,
Planning and execution of administrative operations for Emin Cable,
Ensuring the safety of Emin Cable's facilities, business partners, and suppliers and preventing security breaches,
Compliance with the legislation in force in Turkey and abroad,
Providing information to the competent authorities within the scope of the audit, inspection, and investigation activities conducted in accordance with the legislation in force in Turkey and abroad,
Resolving legal disputes or initiating legal processes,
Development and application of Emin Cable's HR policies and processes,
Participation in promotional activities and events,
Planning and execution of Emin Cable's corporate governance activities,
Execution of Emin Cable's communication activities with its stakeholders.
Within the framework of these purposes, personal data is processed by Emin Cable within the scope of the principles and conditions specified in the legislation, and the related individuals are informed and enlightened about the processing of their personal data in accordance with the relevant legislation.
C. RETENTION PERIODS OF PERSONAL DATA
The retention periods of personal data processed by Emin Cable are determined in accordance with the provisions of the relevant legislation or the period required for the purpose of processing the data.
In accordance with the KVKK and other relevant legislation, the retention periods of personal data processed by Emin Cable are determined as follows;
Personal data processed for the purpose of ensuring legal, technical, and commercial-business security; ensuring compliance with the legislation; and ensuring Emin Cable's and business partners' and suppliers' financial, accounting, and auditing activities are retained for the statutory limitation periods specified in the applicable legislation.
Personal data processed for the purpose of planning and execution of corporate communication activities, execution of marketing and sales activities, ensuring corporate sustainability, and execution of Emin Cable's and business partners' and suppliers' commercial and business strategies are retained for the duration of the legal relationship with Emin Cable and for the statute of limitations periods arising from the related legislation.
Personal data processed for the purpose of preparation and storage of operational, financial, and other records of Emin Cable and business partners and suppliers; execution of administrative operations for Emin Cable; ensuring safety and preventing security breaches; participation in promotional activities and events; and planning and execution of corporate governance activities of Emin Cable are retained for the duration of the legal relationship with Emin Cable and for the statute of limitations periods arising from the related legislation.
Camera records and monitoring records of entry-exit transactions processed for the purpose of ensuring security are kept for 30 days, except for cases where a longer period is stipulated by the legislation or requested by the relevant authorities due to a legal dispute or investigation.
Personal data processed for the purpose of resolving legal disputes or initiating legal processes are retained for the duration of the legal dispute or legal process and for the statutory limitation periods specified in the applicable legislation.
Personal data processed for the purpose of development and application of Emin Cable's HR policies and processes are retained for the duration of the legal relationship with Emin Cable and for the statute of limitations periods arising from the related legislation.
For other personal data, the retention periods are determined by taking into account the purpose of processing and the provisions of the related legislation. In this context, personal data are deleted, destroyed, or anonymized upon the expiration of the retention periods specified in the relevant legislation or the cessation of the purpose of processing.
V. RIGHTS OF THE DATA SUBJECT
The rights of the data subject regarding the personal data processed by Emin Cable are listed below;
Right to learn whether personal data is processed,
Right to request information if personal data has been processed,
Right to learn the purpose of processing personal data and whether they are used in accordance with their purpose,
Right to know the third parties to whom personal data is transferred domestically or abroad,
Right to request correction of personal data in case of incomplete or incorrect processing,
Right to request the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation,
Right to request notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data have been transferred,
Right to object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
Right to request the compensation of the damage in case of damage due to the unlawful processing of personal data.
Applications regarding the exercise of the rights listed above can be made by filling in the Data Subject Application Form available at www.emincable.com and sending it to Emin Cable by hand, registered mail, or through a notary. Emin Cable will finalize the requests in the application as soon as possible and within thirty days at the latest, depending on the nature of the request, free of charge, and will notify the data subject in writing or electronically. However, if the transaction requires an additional cost, Emin Cable may charge the fee in the tariff determined by the Personal Data Protection Board.
VI. MEASURES REGARDING THE PROCESSING OF PERSONAL DATA
A. TECHNICAL MEASURES
Emin Cable takes technical measures to ensure the security of personal data processed within the scope of personal data protection. These measures are;
Access controls (personnel access rights, etc.),
Data entry controls (password policies, etc.),
Data access controls (confidentiality agreements, etc.),
Data transmission controls (encryption, etc.),
Input controls (filtering, etc.),
Data storage controls (access authorization, etc.),
Data separation controls (access authorization, etc.),
Regular system checks and monitoring,
Performance of vulnerability assessments,
Ensuring secure remote access to the system.
B. ADMINISTRATIVE MEASURES
Emin Cable takes administrative measures to ensure the security of personal data processed within the scope of personal data protection. These measures are;
Establishing a corporate personal data protection policy,
Training of employees and managers,
Regular checks of compliance with personal data protection rules,
Establishing a personal data inventory,
Establishing a personal data processing registry,
Determining the personal data retention and destruction policy,
Establishing data breach notification procedures,
Ensuring compliance with national and international legislation and standards.
C. LEGAL MEASURES
Emin Cable takes legal measures to ensure the security of personal data processed within the scope of personal data protection. These measures are;
Preparation and implementation of agreements regarding the protection of personal data,
Preparation and execution of internal regulations,
Ensuring the fulfillment of legal obligations regarding personal data protection,
Follow-up of judicial decisions and administrative decisions regarding personal data protection,
Implementation of the decisions of the Personal Data Protection Board,
Effective and timely response to applications and complaints regarding personal data,
Ensuring the cooperation with the Personal Data Protection Board and other relevant public institutions and organizations,
Effective and timely response to requests and instructions regarding personal data protection from public institutions and organizations.
VII. OTHER ISSUES
Communication, hosting, and other services are outsourced within the scope of Emin Cable's personal data processing activities, and data protection compliance checks are carried out for the personal data transferred to the service provider. In this context, service providers are selected from companies that can provide adequate security and service quality in accordance with the relevant legislation, and necessary agreements are made to ensure data security. In addition, Emin Cable regularly monitors whether the data processing activities of the service provider are carried out in accordance with the relevant legislation and the agreements made.
Emin Cable reserves the right to update and change the Policy on the Protection and Processing of Personal Data in line with changes in the legislation, changes in the business processes, and changes in the activities of Emin Cable. For this reason, it is recommended that the Policy on the Protection and Processing of Personal Data be reviewed periodically.
Emin Cable attaches importance to the confidentiality and security of personal data and takes all necessary technical and administrative measures to protect personal data. However, the security of personal data also depends on the precautions taken by the data subjects. Therefore, the data subject must take the necessary care and attention to ensure the security of their personal data.
Emin Cable recognizes the importance of raising awareness about personal data protection, and in this context, it provides training and informative activities for its employees and business partners. In addition, it informs data subjects about the protection and processing of personal data and the rights of the data subjects through various channels such as the company website and communication tools.
The Policy on the Protection and Processing of Personal Data is effective as of its publication date.
RETENTION PERIODS OF PERSONAL DATA
Personal data is stored for the period required by the purpose of processing, subject to the retention periods specified in the legislation. Details of the retention and destruction periods are included in the Emin Cable Storage and Destruction Policy published on the official website.
In cases where personal data is processed for multiple purposes, if there is no legal obstacle to deleting, destroying, or anonymizing the data upon the disappearance of the processing purposes or upon the request of the Data Subject, such actions are taken. Destruction, deletion, or anonymization is carried out in compliance with the provisions of the legislation and decisions of the Personal Data Protection Board.
Measures regarding the storage of personal data
a. Technical measures
The technical measures taken regarding the protection of personal data are as follows:
Emin Cable has technical tools and equipment suitable for each destruction method specified in this policy.
Risks preventing the unlawful processing of personal data are identified, ensuring that appropriate technical measures are taken to mitigate these risks, and technical controls are conducted on the measures taken.
Access to areas where personal data is stored is recorded, and unauthorized accesses or access attempts are controlled.
Emin Cable takes necessary measures to ensure that deleted personal data is inaccessible and cannot be reused for relevant users.
Strong passwords are used in electronic environments where personal data is processed.
Data backup programs ensuring secure storage of personal data are used.
A separate policy has been established for the security of special category personal data.
Employees involved in the processing of special category personal data have been provided with training on the security of special category personal data, confidentiality agreements have been signed, and the authorities of users with access to data have been defined.
Physical environments where special category personal data is processed, stored, and/or accessed are secured with adequate security measures, physical security is ensured, and unauthorized entries and exits are prevented.
b. Administrative measures
The administrative measures taken regarding the protection of personal data are as follows:
Employees are informed about the technical and administrative risks related to the storage of personal data to create awareness.
In cases where cooperation is made with third parties for the storage of personal data, the contracts with the companies to which personal data is transferred include provisions regarding the protection and secure storage of transferred personal data.
Texts are created and published regarding the obligation to inform employees, customers, visitors, and employee candidates, within the scope of the obligation to inform, after which clear and explicit consent texts are prepared based on the open and clear will of the relevant individuals.
Layered enlightenment tables are posted regarding camera systems.
The security of places where personal data is located is ensured, locked cabinet systems are used.
Privacy agreements (Supplier, Franchise, Dealer) are signed.
V. SECURITY OF PERSONAL DATA
A. Obligations regarding the security of personal data
In accordance with the regulation of the Law No. 6698 on the Protection of Personal Data regarding the processing of personal data, "Personal Data Cannot Be Processed Without the Explicit Consent of the Data Subject." However, personal data can be processed without the consent of the data subject if one of the following conditions exists:
Explicitly Stipulated in Laws
Impossibility of Obtaining the Explicit Consent of the Data Subject Due to Actual Impossibility
Directly Related to the Establishment or Performance of a Contract
Fulfillment of the Legal Obligation of the Company
Disclosure of Personal Data by the Data Subject
Necessity for the Establishment, Exercise, or Protection of a Right
Necessity for the Legitimate Interests of Our Company Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Subject
B. PROCESSING OF SPECIAL CATEGORY PERSONAL DATA
Processing of special category personal data (race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation, or union membership, health, sexual life, criminal conviction, and security measures as well as biometric and genetic data) without the explicit consent of the data subject is prohibited by law. Personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by laws. Personal data relating to health and sexual life may only be processed without the explicit consent of the data subject for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment, and care services, planning and managing health services and their financing, under the obligation of confidentiality, by persons or authorized boards and organizations.
VIII. THIRD PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED BY EMİN CABLE AND PURPOSES OF TRANSFER
Personal data;
To Mediation Department,
To Dealer Network and Sales Points,
To Franchise and Dealer Networks,
To Business partners and business connections,
To legally authorized public institutions and organizations,
To private legal entities providing services,
To Shareholders,
To Social Security Institution,
To Suppliers,
To Group Companies, and,
To Authorized Public Institutions, personal data may be transferred within the framework of the purposes specified below.
The Purposes of Transfer of Personal Data are as Follows:
For the conduct of activities,
To provide support services to customers within the scope of contracts and service standards,
To determine the preferences and needs of customers and shape the service provided accordingly, update it,
To fulfill legal obligations as required or obligatory by legislation,
To conduct market research and statistical studies,
To organize surveys, competitions, promotions, and sponsorships,
To evaluate job applications,
To establish contact with individuals in business relations with the company,
Management of marketing processes,
Management of seller/supplier relationships,
Completion of legal reporting and invoicing processes.
A. Transfer of Personal Data
Conditions for Transfer of Personal Data to Domestic
Emin Cable acts in accordance with the decisions and regulations taken by the Personal Data Protection Authority (KVKK) and the KVKK regarding the transfer of personal data.
Subject to the exceptional cases stipulated in the legislation, personal data and personal data of special nature are not transferred by Emin Cable to other real persons or legal entities without the explicit consent of the data subject.
In exceptional cases stipulated by the KVKK and other legislation, personal data may be transferred to administrative/judicial authorities or private legal entities authorized in accordance with the legislation without the explicit consent of the data subject, in the manner and within the limits prescribed by the legislation.
Conditions for Transfer of Personal Data Abroad
As a rule, personal data is not transferred abroad without the explicit consent of the data subject.
In cases where one of the exceptional situations exists, if third parties in foreign countries are:
Located in countries where the KVKK Board has declared sufficient protection;
In case they are located in countries where adequate protection is not available, provided that the data controllers in Turkey and in the foreign country concerned undertake adequate protection in writing and the permission of the KVKK Board is obtained, personal data may be transferred abroad without explicit consent.
a. Institutions and organizations to which personal data are transferred
Personal data;
To Mediation Department,
To Dealer Network and Sales Points,
To Franchise and Dealer Networks,
To Business partners and business connections,
To legally authorized public institutions and organizations,
To private legal entities providing services,
To Shareholders,
To Social Security Institution,
To Suppliers,
To Group Companies, and,
To Authorized Public Institutions, personal data may be transferred in accordance with the principles and rules stated above.
B. Transfer of Personal Data of Special Nature
Conditions for Transfer of Personal Data of Special Nature to Domestic
Emin Cable, within the scope of the purposes of data processing, may transfer personal data of special nature to third parties by taking necessary administrative and technical measures. In this regard, Emin Cable may transfer Special Qualitative Personal Data to third parties if one of the processing conditions specified in the above section and the conditions specified below are met.
In addition, in exceptional cases stipulated by the legislation,
Personal data of special nature concerning the health and sexual life of the data subject may be transferred without the explicit consent of the data subject to persons or authorized institutions or organizations under the obligation of confidentiality, within the scope of processing by persons or authorized institutions or organizations responsible for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.
Conditions for Transfer of Personal Data of Special Nature Abroad
Emin Cable, by taking necessary care and administrative and technical measures and the measures deemed necessary by the Board, may transfer Personal Data of Special Nature of the data subject to a foreign country where the data controller providing sufficient protection or undertaking adequate protection is located, within the scope of legitimate and lawful purposes of personal data processing. In case of explicit consent of the data subject, Personal Data may be transferred abroad.
b. If explicit consent of the data subject is not available;
c. Personal data of special nature other than the health and sexual life of the data subject (race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress, membership of associations, foundations or trade unions, criminal conviction, and security measures related data, as well as biometric and genetic data), in cases stipulated by the laws,
d. Personal data concerning the health and sexual life of the data subject may be transferred abroad within the scope of processing by persons or authorized institutions or organizations under the obligation of confidentiality, for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.
IX. DATA PROCESSING ACTIVITIES REGARDING VISITORS TO THE WORKPLACE AND THE WEBSITE
A. MONITORING ACTIVITIES WITH CAMERA IN THE WORKPLACE
For the purpose of ensuring the security of the workplace, employees, visitors, and customers, and limited to this purpose, monitoring activities are carried out with security cameras,
Announcement of monitoring activities with cameras,
Ensuring the security of the data obtained,
The retention period of personal data obtained through monitoring,
Information about who has access to the information obtained through monitoring and to whom this information is transferred, are added to the "layered" enlightenment texts as announced on the official website of the Personal Data Protection Authority. Layered Camera Enlightenment Texts have been hung in all places where camera systems are located in the form of tables.
B. TRACKING OF VISITOR ENTRY-EXIT RECORDS AT THE WORKPLACE
For the purpose of ensuring security and other purposes specified in this Policy, personal data processing activities are carried out for tracking workplace visitor entry-exit records. When obtaining the identity data of individuals who come as guests to Company buildings, the relevant person is informed through texts displayed at Emin Cable or through other means. Data obtained for tracking visitor entry-exit is processed only for this purpose and the relevant personal data is recorded in the data recording system in physical environments.
C. STORAGE OF RECORDS REGARDING INTERNET ACCESS PROVIDED TO VISITORS IN THE WORKPLACE
For the purpose of ensuring security and other purposes specified in this Policy, during the period of staying in the workplace, internet access is provided to visitors upon request. In this case, log records of internet access are kept in accordance with the provisions of Law No. 5651 and the regulations prepared in accordance with this Law, and these records are processed only when requested by authorized public institutions and organizations or in audit processes to fulfill the relevant legal obligation within the Company.
D. WEBSITE VISITORS
Cookie records are used to improve the functioning and usage of the Emin Cable official website. The aim is to make the time spent on the official website of the Company more efficient and enjoyable. In addition, some cookies are used to remember preferences on the website, thus providing users with an improved and personalized experience. Personal data is collected, processed, transferred, and stored through cookies used on the website. For detailed information about cookies used on the website, you can review the "Emin Cable Cookie Policy" on the official website.
X. CONDITIONS FOR DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
In accordance with Article 138 of the Turkish Penal Code, Article 7 of the KVKK, and the "Regulation on Deletion, Destruction, and Anonymization of Personal Data," even if processed in accordance with the relevant legal regulations, personal data is deleted, destroyed, or anonymized by Emin Cable upon its own decision or at the request of the data subject when the reasons requiring processing cease to exist. Emin Cable has created a policy in this regard in accordance with the provisions of the regulation, and data is destroyed according to the nature of the data. Within the scope of this regulation, periodic destruction dates have been determined by Emin Cable, and a schedule has been created for periodic destruction at various intervals since the obligation begins.
A. OBLIGATION TO DELETE, DESTROY, AND ANONYMIZE PERSONAL DATA
In case all conditions for the processing of personal data specified in Articles 5 and 6 of the KVKK cease to exist, the data controller must delete, destroy, or anonymize personal data either ex officio or upon the request of the data subject. The data controller is obliged to act in accordance with the general principles in Article 4 of the Law, the technical and administrative measures to be taken within the scope of Article 12, relevant legislation, decisions of the Board, and the personal data retention and destruction policy. The data controller is obliged to explain the methods it applies for deleting, destroying, or anonymizing personal data in its relevant policies and procedures. In accordance with Article 7 of the "Regulation on Deletion, Destruction, and Anonymization of Personal Data," Emin Cable has also created a Storage and Destruction Policy.
B. TECHNIQUES FOR DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
Techniques for Deletion and Destruction of Personal Data
Physical Destruction
Secure Deletion Software
Sending to a Specialist for Secure Deletion
Techniques for Anonymization of Personal Data
Masking
Aggregation
Data Derivation
Data Shuffling, Permutation
XI. RIGHTS OF THE DATA SUBJECT; EXERCISE AND EVALUATION OF THESE RIGHTS
A. RIGHTS OF THE DATA SUBJECT AND EXERCISE OF THESE RIGHTS
Rights of the Data Subject
Within the scope of the obligation to inform, the Data Subject is informed by Emin Cable, and systems and infrastructures for this information are established. Technical and administrative arrangements necessary for the Data Subject to exercise their rights regarding personal data are made by Emin Cable.
The Data Subject has the right to:
Learn whether personal data is being processed,
Request information if personal data has been processed,
Learn the purpose of processing personal data and whether they are being used for their intended purpose,
Know the third parties to whom personal data are transferred within the country or abroad,
Request correction if personal data is incomplete or inaccurate,
Request deletion or destruction of personal data if the reasons for processing cease to exist,
Request notification of the correction, deletion, or destruction to third parties to whom the personal data has been transferred,
Object to a result against the Data Subject that arises from the analysis of processed data exclusively by automatic systems,
Claim compensation if the Data Subject incurs damages due to the unlawful processing of personal data, they have rights.
Procedure for Data Subject Application
The Data Subject can apply to Emin Cable in accordance with the application procedures specified in the Communiqué on Principles and Procedures for Application to the Data Controller for their requests related to the rights listed above.
Requests within the scope of the rights specified in Article 11 of the Law on the Protection of Personal Data No. 6698 can be submitted by filling out the form on the website www.emincable.com, using one of the methods described below, in accordance with Article 13 of the Law and Article 5 of the Communiqué on Principles and Procedures for Application to the Data Controller.
Applications received by the Company will be answered within 30 days from the date the request is received by the Company, according to Article 13/2 of the Law. Responses to the application will be sent to the applicant in writing and electronically in accordance with Article 13 of the Law.
Right to Lodge a Complaint with the Personal Data Protection Board
In cases where the application is rejected, the response to the application is found to be insufficient, or no response is received within the specified period, the Data Subject has the right to lodge a complaint with the Personal Data Protection Board within 30 (thirty) days from the date they learn the response, and in any case, within 60 (sixty) days from the application date.
B. INSTANCES WHERE THE DATA SUBJECT CANNOT EXERCISE THEIR RIGHTS
Pursuant to Article 28/2 of the Law on the Protection of Personal Data, except for the right to claim compensation in the following cases, it will not be possible for individuals to benefit from the rights specified in Article 11 of the Law;
Where processing of personal data is necessary for the prevention of a crime or for the investigation of a crime,
Where personal data, which has been made public by the Data Subject themselves, is processed.
XII. ACTIONS TO BE TAKEN IN CASE OF A BREACH
In the event of a breach despite all technical and administrative measures taken by Emin Cable, a clear and simple notification will be made to the Data Subject. This notification will include;
The date of the breach,
Which personal data has been affected by the breach, categorized by personal data / special category personal data,
The potential consequences of the personal data breach,
Measures taken or recommended to mitigate the adverse effects of the data breach,
The name and contact details of the contact persons who will enable the Data Subjects to receive information about the data breach.
XIII. MANAGEMENT STRUCTURE OF EMİN CABLE AUTOMOTIVE PERSONAL DATA PROTECTION AND PROCESSING POLICY
The Data Protection Committee has been assigned by the Company Board of Directors' decision to manage this Policy and other related policies. The duties of this Committee regarding the protection and processing of personal data are as follows:
To prepare and implement basic policies on the protection and processing of personal data and submit them for approval by the Board of Directors, and to decide how the implementation and supervision of policies regarding the protection and processing of personal data will be carried out and to ensure coordination in this regard, including internal staffing and coordination within the company and with institutions collaborating with the Company,
To determine and submit for approval by the Board of Directors the matters to be ensured for compliance with the Law on the Protection of Personal Data and related legislation, to monitor their implementation, and to ensure coordination, to increase awareness within the Company and the institutions the Company collaborates with regarding the protection and processing of personal data,
To identify risks that may arise in Emin Cable's personal data processing activities, ensure the necessary measures are taken to address them, submit improvement proposals to the Board of Directors for approval, and ensure coordination in this regard,
To organize training sessions to ensure that relevant individuals are informed about the protection and processing of personal data and their legal rights regarding personal data processing activities,
To adjudicate on Data Subject applications,
To monitor developments and regulations regarding the protection of personal data and take necessary measures within the Company in line with these developments and regulations, and to maintain relations with the Personal Data Protection Board and Authority,
To carry out other duties assigned by the Company Board of Directors regarding the protection of personal data.