Disclosure Statement on the Protection of Personal Data

This English version is provided for information purposes. In the event of any discrepancy between the Turkish and English versions, the Turkish version shall prevail.

This Disclosure Statement has been prepared by DORUKSİSTEM MÜHENDİSLİK TEKNOLOJİ VE DANIŞMANLIK SAN.TİC. A.Ş. (“DORUKSİSTEM”), acting in its capacity as data controller, in accordance with the Turkish Personal Data Protection Law No. 6698 (the “Law” or “KVKK”), in order to provide explanations regarding the processing of the personal data of “data subjects”, to inform data subjects, and to fulfil the obligation to inform arising from Article 10 of the Law.

This Disclosure Statement aims to provide information on the practices carried out by DORUKSİSTEM to protect fundamental rights and freedoms, in particular the privacy of private life. Ensuring and protecting information security and respecting ethical values are among our priority principles.

1. Categories of Personal Data Processed by Data Subject Group

• Shareholders/partners: identity information (name, surname, date of birth, Turkish ID number), identity information (corporate business cards), contact information (residential address, mobile and home telephone), legal transaction information (follow-up of lawsuits filed in their name concerning the company), financial information (bank account details, invoice details), transaction security and financial information (user system logs), risk management information (risk assessment of shareholders), visual records (security camera system) and other information (information security policies, confidentiality and disciplinary agreements, organisational activities carried out with news and media organisations, social event photographs, training videos and photographs, posts on the company’s social media accounts, education information, driving licence class).
• Employees: identity information (name, surname, date of birth, Turkish ID number, gender, marital status), identity information (corporate business cards), contact information (residential address, mobile and home telephone), criminal conviction and security measure information (criminal record), financial information (salary account details), transaction security information (user system logs), visual records (security camera system), personnel file information (service contract, indefinite-term employment contract, insured employment start notification, payslip, payroll accrual data, attendance data, annual leave, administrative leave and unpaid leave requests, insured employment termination notification, employment certificate, documents and reports issued upon termination of the service contract, administrative procedures required for occupational accidents and Social Security Institution (SGK) occupational accident notifications, occupational accident report, and all information and documents legally required to be kept in the personnel file) and other information (information security policies, confidentiality and disciplinary agreements, passport information, information required for visas, education information, driving licence class, passport-size photograph, identification of first-degree family members for minimum living allowance calculations, military service status, health fitness information, organisational activities carried out with news and media organisations, social event photographs, training videos and photographs, posts on the company’s social media accounts).
• Supplier employees: identity information (name, surname, date of birth, Turkish ID number), contact information (mobile phone, residential address), personnel file information (employment start date, diploma), transaction security information, visual records (security camera system) and other information (driving licence class).
• Interns: identity information (name, surname, date of birth, Turkish ID number, gender, marital status), contact information (residential address, mobile and home telephone), visual records (security camera system), personnel file information (occupational accident report, all information and documents legally required to be kept in the personnel file), financial information (salary account details) and other information (education information, passport-size photograph, photograph, health fitness information, organisational activities carried out with news and media organisations, social event photographs, posts on the company’s social media accounts).
• Job applicants: identity information (name, surname, date of birth, place of birth, gender, marital status), contact information (residential address, mobile and home telephone, e-mail), professional experience information (current employment status, certificates, training), criminal conviction and security measure information (criminal record), visual records (security camera system) and other information (driving licence class, military service status, travel restrictions, availability to work outside working hours, health information regarding suitability for working conditions, reference information, education information, foreign language skills).
• Visitors: identity information (name, surname), contact information (telephone number, e-mail address), visual and audio records (switchboard calls with the reference person) and other information (the organisation they work for, if any).
• Parents/guardians/representatives: identity information (name and surname of the reference person), contact information (telephone number and e-mail address of the reference person).
• Persons purchasing products and services: identity information (name and surname), contact information (e-mail address, company name, telephone number).
• Trade fair visitors: identity information (name, surname), contact information (e-mail address, company name, telephone number).

2. Purposes of Processing Personal Data

• Conducting selection and placement processes for job applicants, interns and students;
• Conducting the application processes of job applicants;
• Fulfilling obligations arising from employment contracts and legislation for employees;
• Conducting processes for new rights and benefits for employees;
• Conducting audit and ethics activities;
• Conducting training activities;
• Managing access authorisations;
• Conducting activities in compliance with legislation;
• Conducting finance and accounting operations;
• Ensuring the security of physical premises;
• Following up and conducting legal proceedings;
• Conducting assignment processes;
• Conducting communication activities;
• Conducting goods and service production operations;
• Conducting customer relationship management processes;
• Conducting activities aimed at customer satisfaction;
• Conducting risk management processes;
• Conducting social responsibility and civil society activities;
• Conducting contract processes;
• Conducting human resources processes;
• Ensuring the security of movable property and resources;
• Conducting supply chain management processes;
• Ensuring the security of data controller operations;
• Conducting investment processes;
• Providing information to authorised persons, institutions or organisations;
• Conducting management activities;
• Conducting information security processes.

3. Parties to Whom Personal Data May Be Transferred and Purposes of Transfer

Your personal data collected by DORUKSİSTEM may be shared, for the purposes detailed above, with the persons, institutions or organisations detailed below, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVKK. Accordingly:

• Identity information of shareholders/partners (name, surname, date of birth, Turkish ID number, foreign national ID number), contact information of supplier employees (mobile phone, residential address), personnel file information of supplier employees (employment start date, diploma), health information of supplier employees (SGK information), contact information of shareholders/partners (residential address, mobile and home telephone), contact information of employees (residential address, mobile and home telephone), criminal conviction and security measure information of employees (criminal record), contact information of interns (residential address, mobile and home telephone), other information of shareholders/partners (education information, driving licence class), other information of employees (education information, driving licence class, identification of first-degree family members for minimum living allowance calculations, military service status, health fitness information, graduation diploma, driving licence), identity information of employees (name, surname, date of birth, Turkish ID number, gender), personnel file information of employees (service contract, insured employment start notification, payslip, payroll accrual data, attendance data, all information and documents legally required to be kept in the personnel file), salary account details of employees, identity information of supplier employees (name, surname, date of birth, Turkish ID number), personnel file information of interns (occupational accident report, all information and documents legally required to be kept in the personnel file), financial information of interns (salary account details), other information of job applicants (driving licence class, military service status, education information) and health information of job applicants (health problems) — with authorised public institutions and organisations;
• Legal transaction information of shareholders/partners (follow-up of lawsuits relating to the company) — with authorised public institutions and organisations and with the company’s law firm;
• Transaction security information of shareholders/partners (user system logs) and transaction security information of employees (user system logs) — with public institutions and organisations and with the Information and Communication Technologies Authority (BTK);
• Financial information of shareholders/partners (user system logs) and financial information of employees — with authorised public institutions and organisations and with contracted banks;
• Risk management information of shareholders/partners (user system logs, risk assessment of shareholders) — with authorised public institutions and organisations and, where requested, with the KVKK committee and audit firms;
• Other information of shareholders/partners, employees and interns (social event photographs, posts on the company’s social media accounts, organisational activities carried out with news and media organisations) and identity information of shareholders/partners and employees (corporate business cards) — publicly, with the relevant persons;
• Other information of employees (passport information, information required for visas) — with business partner(s).

The personal data listed above may be shared and transferred by taking all necessary measures and, where required, by obtaining the consent of the data subject. In addition, personal data may also be shared with public institutions and organisations authorised to request and receive such personal data in line with legal requirements.

4. Method and Legal Basis of Collecting Personal Data

Your personal data are collected, used, recorded, stored and processed by DORUKSİSTEM verbally, in writing or electronically, through channels such as e-mail, electronically through the social media accounts you allow DORUKSİSTEM to access, and/or through the call centre. Your personal data may also be processed and shared within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the Law, and in line with the legal grounds and purposes set out in sections 1 and 2 of this Disclosure Statement.

5. Personal Data Processed by DORUKSİSTEM Based on Your Explicit Consent and Purposes of Processing

DORUKSİSTEM may process your personal data specified within the scope of this Disclosure Statement, remaining bound by the purposes specified within the scope of this Disclosure Statement.

6. Retention Period of Personal Data

Your personal data are retained for the retention periods specified in the relevant legislation (or, where no period is specified in the relevant legislation, in accordance with our Company’s practices and commercial customs, or for as long as required by the processing purposes mentioned above), and are thereafter deleted, destroyed or anonymised in accordance with the KVKK.

Where the purpose of processing personal data has ended and the retention periods set by the relevant legislation and by our Company have expired, personal data may be retained only to serve as evidence in possible legal disputes, to assert a right related to the personal data, or to establish a defence. In determining these periods, retention periods are set based on the statutory limitation periods for asserting the relevant right and on examples of requests previously addressed to our Company on the same matters despite the expiry of the limitation periods.

In this case, the retained personal data are not accessed for any other purpose, and access to the relevant personal data is provided only when they need to be used in the relevant legal dispute. After the period mentioned here expires, the personal data are deleted, destroyed or anonymised.

7. Security of Personal Data

In order to ensure that your personal data are not exposed to unauthorised access, lost or damaged in the environments in which they are processed and stored, the requirements of the technical and administrative measures on the security of personal data published by the Personal Data Protection Board are regularly reviewed and implemented by our Company.

8. Rights of the Data Subject

Under Article 11 of the KVKK, you as the data subject have the following rights:

• To learn whether your personal data are processed;
• To request information if your personal data have been processed;
• To learn the purpose of processing your personal data and whether they are used in accordance with that purpose;
• To know the third parties to whom your personal data are transferred in Türkiye or abroad;
• To request the rectification of your personal data if they are incomplete or inaccurately processed, and to request that the action taken in this regard be notified to third parties to whom your personal data have been transferred;
• To request the deletion or destruction of your personal data where the reasons requiring their processing have ceased to exist, even though they have been processed in accordance with Law No. 6698 and other relevant laws, and to request that the action taken in this regard be notified to third parties to whom your personal data have been transferred;
• To object to a result arising to your detriment through the analysis of the processed data exclusively by automated systems;
• To claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.

9. Methods of Application Regarding the Rights of the Data Subject

Pursuant to paragraph 1 of Article 13 of the KVKK, you may submit your request to exercise the rights listed above using the methods and information below, in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller” published in the Official Gazette No. 30356 dated 10 March 2018. DORUKSİSTEM will conclude the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the action requires an additional cost, DORUKSİSTEM reserves the right to charge a fee based on the tariff determined by the Personal Data Protection Board.

Written applications to our Company may be submitted by printing out the DORUKSİSTEM Disclosure Application Form and:

• in person by the applicant;
• through a notary public;
• by signing it with a “secure electronic signature” as defined in Electronic Signature Law No. 5070 and sending it to our registered electronic mail (KEP) address or to our corporate e-mail address given below.