PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. INTRODUCTION

 Çağdaş Makina İthalat İhracat Sanayi Tic. Ltd. Şti. (“Company”), as the data controller, the protection of personal data of its customers, employees and other natural persons with whom it has a relationship is of great importance. The process managed by this Policy and other written policies within the Company for the processing and protection of personal data and the targeted goal is to process and protect the personal data of our customers, potential customers, employees, employee candidates, visitors, employees of the organization we cooperate with, employees of the Company we are involved in and third parties in accordance with the law.
 In this context, necessary administrative and technical measures are taken by the Company for the processing and protection of personal data in accordance with Law No. 6698 and the relevant legislation.
 In this Policy, the following basic principles adopted by the Company for the processing of personal data will be explained:

• Processing of personal data within the scope of consent,
• Processing of personal data in accordance with the law and good faith,
• Keeping personal data accurate and updated when necessary,
• Processing personal data for specific, explicit and legitimate purposes,
• Processing personal data in connection with the purpose for which they are processed, limited and measured,
• Retaining personal data for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed,
• Informing and enlightening personal data subjects,
• Creating the necessary infrastructure for personal data subjects to exercise their rights,
• Taking necessary measures for the protection of personal data,
• To act in accordance with the relevant legislation and the regulations of the PDP Board in determining and implementing the purposes of processing personal data and transferring them to third parties,
• Specific regulation of the processing and protection of special categories of personal data.

2. PURPOSE OF THE POLICY

 The main purpose of this Policy is to provide explanations about the personal data processing activities carried out by the Company in accordance with the law and the systems adopted for the protection of personal data, and to provide transparency by informing our customers, employees, employee candidates, visitors, shareholders and employees of the organizations we cooperate with and third parties.
3. SCOPE OF THE POLICY

 This Policy relates to all personal data of our customers, employees, employee candidates, visitors, employees of the institutions we cooperate with and third parties, which are processed automatically or non-automatically provided that they are part of any data recording system.
4. ENFORCEMENT OF THE POLICY

 The policy issued by the Company has been put into effect, published on the Company’s website (www.coiltech.com.tr) and made available to the relevant persons upon the request of the personal data owners.
5. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA

 In accordance with Article 12 of the KVK Law, the Company takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent unlawful processing of personal data, unlawful access to data and to ensure the preservation of data, and conducts or has the necessary audits carried out within this scope.
5.1. Measures Taken to Ensure Lawful Processing of Personal Data

 The Company takes technical and administrative measures to ensure that personal data is processed in accordance with the law, according to technological possibilities and implementation cost.
5.1.1. Technical Measures

 The main technical measures taken by the Company to ensure the lawful processing of personal data are listed below:

• Personal data processing activities carried out within the Company are audited through technical systems established.
• The technical measures taken are periodically reported to the relevant person as required by the internal audit mechanism.
• Trainings are provided to departments on technical issues.

5.1.2. Administrative Measures

 Administrative measures taken by the Company for the lawful processing of personal data:

• Company employees are informed and trained on the law on the protection of personal data and the processing of personal data in accordance with the law.
• All personal data processing activities carried out by the Company are carried out in accordance with the personal data inventory and annexes created by analyzing all business units in detail.
• The personal data processing activities carried out by the relevant departments within the Company; The obligations to be fulfilled in order to ensure that these activities comply with the personal data processing conditions sought by the KVKK have been linked to written policies and procedures by the Company, and each business unit has been informed about this issue and the issues to be considered specific to the activity it carries out have been determined.
• The audit and management of the departments within the Company regarding personal data security is organized by the Information Security Committees. Awareness is raised to ensure the legal requirements determined on a business unit basis, and the necessary administrative measures are implemented through internal policies, procedures and trainings to ensure the supervision of these issues and the continuity of the implementation.
• Service agreements and related documents between the Company and employees include information on personal data and data security, and additional protocols are signed. Efforts have been made to create the necessary awareness for employees on this issue.

The Company conducts a Privacy Impact Assessment in the following cases:

• In new projects involving personal data
• Before the selection of the supplier to whom personal data is transferred
• Before the activities to be carried out within the scope of marketing activities
• In the event of any change in the above-mentioned activities

The Privacy Impact Analysis is subject to the approval of the Company Data Protection Officer.

5.1.3. Technical and Administrative Measures Taken to Prevent Unlawful Access to Personal Data

 The Company takes technical and administrative measures according to the class, nature, technological possibilities and implementation cost of the data to be protected in order to prevent disclosure, access, transfer of personal data by imprudent or unauthorized persons, data leaks within the Company systems or all other forms of unlawful access.

5.1.4. Technical Measures

 The main technical measures taken by the Company to prevent unlawful access to personal data are listed below:

• New technological developments are followed and technical measures are taken on the systems, especially in the field of cyber security, and the measures taken are periodically updated and renewed.
• Access and authorization technical solutions are implemented within the framework of legal compliance requirements determined for each department within the Company.
• Access authorizations are limited, and authorizations are regularly reviewed. Access restrictions are applied to former employees and accounts are closed.
• The technical measures taken in accordance with the internal operation of the Company are reported to the relevant users, the issues that pose a risk are re-evaluated and the necessary technological solutions are produced.
• Software and hardware including virus protection systems, data vulnerability security and firewalls are installed.
• Support is received on technical issues.
• All information systems, including applications where personal data is collected, are regularly subjected to external impact testing to identify security vulnerabilities and the vulnerabilities found according to the results of this test are closed.

5.1.5. Administrative Measures

• Employees are trained on the administrative measures to be taken to prevent unlawful access to personal data.
• Legal compliance, access to personal data and authorization processes are implemented within the company, taking into account the personal data processing processes specific to each department within the company.
• In the contracts signed between the Company and the employees, the scope of lawful personal data processing activities is explained and there are commitments to comply with these issues.
• Additional agreements are made by the Company with the persons to whom personal data are transferred in accordance with the law, including provisions that the persons to whom personal data are transferred will take the necessary security measures to protect personal data and ensure that these measures are complied with in their own organizations.

5.2. Supervision of Measures Taken for the Protection of Personal Data

 There is a Personal Data Privacy Manager within the Company. The Personal Data Privacy Manager, on behalf of the Company, which is the data controller, personally conducts the necessary audits in order to ensure the implementation of the provisions of the Law in its own institution or organization in accordance with its duty arising from Article 12 of the Law and, if necessary, by obtaining support from competent organizations. According to the results of these audits, the violations, negativities and nonconformities identified are notified to the Information Security Management Representative and the Information Security Management Representative takes the necessary measures regarding these issues. In the event that an external service is received by the Company due to technical requirements for the storage of personal data, additional agreements are made with the relevant companies to which personal data are transferred in accordance with the law, and the persons to whom personal data are transferred, which include provisions that the persons to whom personal data are transferred will take the necessary security measures to protect personal data and ensure that these measures are complied with in their own organizations.

6. RIGHTS AND REQUESTS OF THE PERSONAL DATA OWNER

 In accordance with Article 13 of the KVK Law, the Company, as the data controller against the requests of the data subject, has established the Personal Data Application and Response Procedure, which is an annex to the personal data inventory, and the procedures for directing to the written template for applications that do not meet the application conditions specified in the law. Technical preparations have been made in order to take the necessary actions in accordance with these procedures. There is a systematic infrastructure within the Company to ensure the implementation of this procedure. In the event that
personal data owners submit
their requests regarding their rights listed below; by personal application with the presentation of identity card, in writing or by registered electronic mail (KEP) address, secure electronic signature, mobile signature or by using the electronic mail address previously notified to the Company by the relevant person and registered in the Company’s system or by using a software or application developed for the purpose of application, the Company will respond to the request free of charge within thirty days at the latest, depending on the nature of the request. A detailed explanation on this matter is made below in Article 20 of this policy.
 Personal data owners will be able to request all rights in the relevant article of the law, including all processing processes, purposes and transfer information of their personal data with the application they will make in accordance with this procedure.

7. PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA

 The PDP Law attaches special importance to certain personal data due to the risk of causing victimization or discrimination when processed unlawfully. These data are; race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
 The Company acts sensitively in the protection of special quality personal data determined as “special quality” by the KVK Law and processed in accordance with the law. In this context, the technical and administrative measures taken by the Company for the protection of personal data are carefully implemented in terms of special categories of personal data and necessary audits are provided within the Company.
 In this context, the health data of the employees are processed due to the workplace medicine service provided within the Company, and the necessary trainings are provided to the personnel who can access this sensitive personal data, the scope and duration of the access authorization of these personnel are determined, periodic audits are carried out and confidentiality agreements are signed. In the event that the relevant personnel leave their jobs, their access authorization is immediately removed.
 Physical files containing personal health data stored physically in employees’ health files are kept in locked areas accessible only by authorized personnel. No unit other than authorized personnel can access the health data of employees.

8. TRAINING OF COMPANY EMPLOYEES ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

 The Company ensures that the necessary trainings are organized for its employees in order to raise awareness to prevent unlawful processing of personal data, unlawful access to data and to ensure the protection of data.

9. ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA

 In accordance with Article 20 of the Constitution and Article 4 of the KVK Law, the Company carries out personal data processing activities in accordance with the law and good faith, accurate and, where necessary, up-to-date, specific, clear and legitimate purposes, in a purpose-related, limited and measured manner. The Company retains personal data for the period stipulated by law or required by the purpose of personal data processing. The Company processes personal data belonging to its customers, employees, visitors, employees of suppliers and third parties; personal data such as
identity information (name, surname, Turkish ID number, gender, age, date of birth), contact information (e-mail address, telephone number address information, IP address), vehicle information, occupational data, visual and audio data, educational data, family members data, health data and while processing this data, The Company processes personal data within the framework of the performance of contracts, fulfillment of work and financial/legal/commercial obligations, as well as ensuring that the personal data owners listed here can benefit from the Company’s services effectively, improve service diversity, provide services with the principle of “best service” for its customers and be informed about marketing and innovations as a result of these services.
 The Company enlightens the data subjects in accordance with Article 10 of the KVK Law and requests the consent of the data subjects in cases where consent is required, and processes this personal data based on the following criteria.

9.1. Processing in accordance with Law and Good Faith

 The Company acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty in the processing of personal data. In accordance with the principle of compliance with the rule of honesty, the Company takes into account the interests and reasonable expectations of the data subjects while trying to achieve its goals in data processing.

9.2. Ensuring that Personal Data is Accurate and Up-to-Date When Necessary

 Keeping personal data accurate and up-to-date is necessary for the Company to protect the fundamental rights and freedoms of the data subject. The Company has an active duty of care to ensure that personal data is accurate and up-to-date when necessary. For this reason, all communication channels are open for the Company to keep the information of the data subject accurate and up-to-date.

9.3. Processing for Specific, Explicit and Legitimate Purposes

 The Company clearly and precisely determines the purpose of processing personal data that is legitimate and lawful. The Company processes personal data in connection with and necessary for the commercial activity it carries out.

9.4. Being relevant, limited and proportionate to the purpose for which they are processed

 The Company processes personal data within the scope of the purposes related to its field of activity and necessary for the execution of its business. For this reason, the Company processes personal data in a manner suitable for the realization of the specified purposes and avoids the processing of personal data that is not related to the realization of the purpose or is not needed. For example, personal data processing activities are not carried out to meet the needs that may arise later.
9.5. Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are Processed
The Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context; The Company first determines whether a period of time is stipulated for the storage of personal data in the relevant legislation, if a period is determined, it acts in accordance with this period, if a period is not determined, it keeps personal data for the period required for the purpose for which they are processed and specified in the law. The Company takes the retention periods in the personal data inventory as basis, and at the end of the periods specified herein, personal data are deleted, destroyed or anonymized according to the nature and intended use of the data within the framework of the obligations under the Law.

10. INFORMING AND ENLIGHTENING THE PERSONAL DATA SUBJECT

 In accordance with Article 10 of the KVK Law, the Company enlightens personal data owners during the acquisition of personal data. In this context, the Company informs about the identity of the data controller, the identity of the representative, if any, for what purpose the personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data and the rights of the personal data owner according to the nature of the data owner and the data processing process. In this context, Clarification Texts are placed on the website and in the office so that customers can easily see them. Customer disclosure text, cookie policy and application form have also been published on the Company website together with this policy.

11. TRANSFER OF PERSONAL DATA

 The Company may transfer the personal data and sensitive personal data of the personal data owner to third parties by taking the necessary security measures in line with the lawful personal data processing purposes. Personal data may be transferred by the Company to foreign countries declared by the PDP Board to have adequate protection or, in the absence of adequate protection, to foreign countries where the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing and where the PDP Board has permission. Reasons for transfer are explained below:

• If there is a clear regulation in the laws regarding the transfer of personal data,
• If it is necessary to transfer personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
• If personal data transfer is mandatory for the Company to fulfill its legal obligation,
• If personal data transfer is mandatory for the establishment, exercise or protection of a right,
• If personal data transfer is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

12. Company PERSONAL DATA INVENTORY AND PERSONAL DATA CLASSIFICATION

 In line with the legitimate and lawful personal data processing purposes of the Company, in accordance with the legitimate and lawful personal data processing purposes of the Company, based on and limited to one or more of the personal data processing conditions specified in Article 5 of the KVK Law, by complying with the general principles specified in the KVK Law and all obligations regulated in the KVK Law, especially the principles specified in Article 4 regarding the processing of personal data, and by complying with the personal data owners within the scope of this Policy (customers, employees, visitors, third parties, third parties). The personal data in the categories specified below, limited to
the personal data owners within the scope of this Policy (customers, employees, visitors
, third parties, third parties, employee candidates, employees of the institutions we cooperate with), are processed by informing the relevant persons by
complying with the general principles specified in the KVK Law and all obligations regulated in the KVK Law.
 The Company has created a personal data inventory in accordance with the Data Controllers Registry Regulation issued by the Personal Data Protection Authority. This data inventory includes data categories, data source, data processing purposes, data processing process, recipient groups to which data is transferred and retention periods. In this context, the Company’s personal data inventory includes, but is not limited to, the following types of data categories.

The Company has completed data classifications within the scope of data processing activities and based on the types of data used within the Company.   In the Personal Data Inventory; as shown in the table shown above, as well as; In accordance with the ISMS Identification, Classification and Protection of Assets Instruction, Destruction Instruction, data classifications have been completed and retention periods have been determined with their justifications.

13. PURPOSES OF PROCESSING PERSONAL DATA

 The Company processes personal data limited to the purposes and conditions within the personal data processing conditions specified in paragraph 2 of Article 5 and paragraph 3 of Article 6 of the KVK Law. These purposes and conditions are:

• Customers; service promotion, information, ,
• Improving service quality and providing better service,
• Invoice issuance for our services,
• Procurement of services from external sources,
• Providing customers with the benefits of specialized organizations in order to receive services and technology services on issues that are not in their area of expertise,
• Identity confirmation,
• Responding to questions and complaints,
• Taking necessary technical and administrative measures within the scope of data security,
• Financial reconciliation with relevant business partners and other third parties regarding the products and services offered,
• Providing the necessary information in line with the requests and audits of regulatory and supervisory institutions and official authorities,
• Maintaining information on data that must be kept in accordance with the relevant legislation,
• Ensuring control over the consistency of their information,
• Measuring customer satisfaction,
• In terms of employees; creating a personal file, determining whether they are capable of fulfilling the requirements of the job continuously, private health insurance, creating a health file, taking occupational safety measures,
• Use of the data received through the website or social media channels for marketing purposes through 3rd party agencies,
• Fulfillment of legal obligations,
• Execution/follow-up of the Company’s financial reporting and risk management processes,
• Execution/follow-up of company legal affairs,
• Creation and follow-up of visitor records.

14. STORAGE PERIODS OF PERSONAL DATA

 If stipulated in the relevant laws and regulations, the Company stores personal data for the period specified in these regulations. If
a period of time is not regulated
in the legislation regarding how long personal data should be kept, personal data is kept for the period required to be kept in accordance with the practices of the Company and the customs of the sector, depending on the activity carried out by the Company while processing that data, and then deleted, destroyed or anonymized in accordance with the relevant policy established by the Company in accordance with the nature of the data.
 If the purpose of processing personal data has expired and the retention periods determined by the relevant legislation and the Company have expired, personal data may be stored only for the purpose of constituting evidence in possible legal disputes or for the assertion or defense of the relevant right related to personal data. In the establishment of the periods here, the retention periods are determined based on the statute of limitations for the assertion of the right in question and the examples in the requests previously addressed to the Company on the same issues despite the expiration of the statute of limitations. In this case, the stored personal data is not accessed for any other purpose and access to the relevant personal data is provided only when it is required to be used in the relevant legal dispute. After the aforementioned period expires, personal data are deleted, destroyed or anonymized.

15. 
    THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED BY THE COMPANY AND THE PURPOSES OF TRANSFER

 In accordance with Article 10 of the KVK Law, the Company informs the personal data owner of the groups of persons to whom personal data are transferred.
 In accordance with Articles 8 and 9 of the KVK Law, the Company may transfer the personal data of the data owners governed by this Policy to the stakeholder categories listed below:

• Company partners,
• Banks and insurance companies,
• Travel agencies,
• Institutions and organizations providing health services to employees,
• Hotels
• Education companies,
• Company suppliers,
• Company to company officials,
• Legally authorized public institutions and organizations,

The scope of transfer and purposes of data transfer are stated below:

16. PROCESSING OF PERSONAL DATA

16.1. Processing of Personal Data

 The explicit consent of the personal data subject is only one of the legal grounds that make it possible to process personal data in accordance with the law. Apart from explicit consent, personal data may also be processed in the presence of one of the conditions specified in the law. The basis of the personal data processing activity may be only one of the following conditions, or more than one of these conditions may be the basis of the same personal data processing activity.

ENTRIES TO THE COMPANY SERVICE BUILDING AND PERSONAL DATA CONDUCTED IN THE BUILDING

 In order to ensure security, the Company carries out personal data processing activities for the monitoring of guest entrances and exits with security cameras in the Company buildings.
 The Company carries out personal data processing activities by using security cameras and recording guest entrances and exits.
 Within the scope of the Company’s security camera monitoring activity; It aims to protect the interests of the company and other persons to ensure the security of the company and other persons. This monitoring activity is carried out in accordance with the KVKK and the Law on Private Security Services and the relevant legislation. In this context, the information that camera surveillance is carried out is announced to all employees and visitors and people are enlightened. Notification letters are posted at the entrances of the monitored areas. In accordance with Article 12 of the KVK Law, the Company takes necessary technical and administrative measures to ensure the security of personal data obtained as a result of camera surveillance.

17.1. Monitoring of Guest Entry and Exit at the Entrances and Inside the Company Service Building

 For the purpose of ensuring security by the Company and for other purposes specified in this Policy, personal data processing activities are carried out to monitor the guest entrances and exits of the Company’s service buildings. While the identity data of the persons who come to the Company’s service buildings as guests are obtained or through the texts posted in the Company or otherwise made available to the guests, the personal data owners in question are enlightened within this scope. The data obtained
for the purpose of tracking guest entry-exit are processed only for this purpose and the relevant personal data are physically recorded in the data recording system.

17.2. Storage of Records Regarding Internet Access Provided to Visitors at the Company’s Service Building

 For the purpose of ensuring security and for other purposes specified in this Policy, the Company may provide internet access to visitors who request it during their stay in the buildings and facilities. In this case, log records regarding internet access are kept in accordance with the Law No. 5651 and the mandatory provisions of the legislation regulated in accordance with this Law, and these records are processed only upon request by authorized public institutions and organizations or in order to fulfill the relevant legal obligation in the audit processes to be carried out within the Company.

18. CONDITIONS FOR THE DESTRUCTION (DELETION, DESTRUCTION AND ANONYMIZATION) OF PERSONAL DATA

 Pursuant to Article 138 of the Turkish Penal Code, Article 7 of the KVK Law and the “Regulation on Deletion, Destruction and Anonymization of Personal Data” issued by the Board, personal data shall be deleted, destroyed or anonymized upon the Company’s own decision or upon the request of the personal data owner in the event that the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the relevant law. The Company has established a policy in this regard in accordance with the provisions of the regulation and makes destruction according to the nature of the data in accordance with this policy. In accordance with this regulation, a Destruction Instruction has been created by the Company within the scope of ISMS, and periodic destruction is carried out at various intervals with the commencement of the obligation.

19. RIGHTS OF PERSONAL DATA OWNERS; EXERCISE OF THESE RIGHTS

 The Company informs the personal data owner of the rights of the personal data owner in accordance with Article 10 of the KVK Law and guides the personal data owner on how to exercise these rights regulated in Article 11, and the Company carries out the necessary channels, internal functioning, administrative and technical arrangements in accordance with Article 13 of the KVK Law in order to evaluate the rights of personal data owners and to provide the necessary information to personal data owners.

19.1. Rights of the Data Subject and Exercise of These Rights

 19.1.1. Rights of the Personal Data Owner

 Personal data owners have the following rights:
a. To learn whether personal data is processed,
b. To request information if personal data has been processed,
c. To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
d. To know the third parties to whom personal data is transferred domestically or abroad,
e. To request
correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
f. To request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and to request notification of the transaction carried out within this scope to third parties to whom personal data is transferred,
g. In the event that the
processed data is analyzed exclusively through automated systems and a result to the detriment of the person himself/herself arises, to object to this result
, h. In case of damage due to unlawful processing of personal data, to request compensation for the damage

19.1.2. Cases where the Personal Data Owner cannot assert his/her rights

 Pursuant to Article 28 of the PDP Law, personal data owners cannot assert their rights listed in 20.1.1. in these matters, since the following cases are excluded from the scope of the PDP Law:
a. Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics,
b. Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime,
c. Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security,
d. Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution procedures.

Pursuant to Article 28/2 of the KVK Law; In the following cases, personal data owners cannot assert their other rights listed in 20.1.1, except for the right to claim compensation for damages:
a. Processing of personal data is necessary for the prevention of crime or criminal investigation,
b. Processing of personal data made public by the personal data owner himself,
c. Processing of personal data is necessary for the execution of supervisory or regulatory duties and disciplinary investigation or prosecution by authorized and authorized public institutions and organizations and professional organizations in the nature of public institutions based on the authority granted by law,
d. Processing of
personal
data is necessary for the protection of the economic and financial interests of the State regarding budget, tax and financial matters.
19.1.3. Exercise of Rights by the Personal Data Owner
Personal data owners may submit
their requests regarding their rights specified in this Policy to the Company free of charge by filling out and signing
the Application Form with the information and documents that will identify their identity and by the methods specified below or by other methods determined by the Personal Data Protection Board. Comprehensive regulation on this subject is made in the Company’s customer clarification text and details regarding the Company’s Personal Data Application request.

• After filling in the form available at www.coiltech.com.tr, a wet signed copy of the form must be submitted in person or in writing by registered mail to the address of Makine İhtisas O.S.B. 16. Sok. No:2 Dilovası / Kocaeli / Turkey or application in person,
• Filling in the form available at www.coiltech.com.tr and sending the form with secure electronic signature to [email protected] e-mail address by registered e-mail after signing it with “secure electronic signature” within the scope of the Electronic Signature Law No. 5070, using secure electronic signature, mobile signature or the e-mail address previously notified to the Company by the relevant person and registered in the Company’s system, or applying to [email protected] e-mail address by using a software or application developed for the purpose of application.

In order for the above-mentioned application to be accepted as a valid application, in accordance with the Communiqué on Application Procedures to the Data Controller, it
is obligatory that the relevant person;
a) Name, surname and signature if the application is in writing,
b) Turkish Republic identification number for citizens of the Republic of Turkey, nationality, passport number or identification number, if any, for foreigners,
c) Residential or workplace address for notification,
ç) Electronic mail address, telephone and fax number for notification, if any,
d) Subject of the request
. Otherwise, the application will not be considered as a valid application.
 For applications to be made without filling out the application form, the issues listed here must be submitted to the Company in full. In order for third parties to make an application request on behalf of personal data owners, there must be a special power of attorney issued by the data owner through a notary public on behalf of the person who will make the application.

Click here to download the application form

20. 
    RELATIONSHIP OF THE COMPANY’S PERSONAL DATA PROTECTION AND PROCESSING POLICY WITH OTHER POLICIES

 The Company has established the principles set forth in this document on the basis of policies regarding other data assets within the Company and sub-procedures for internal use on the protection and processing of personal data.

21. Company PERSONAL DATA PROTECTION AND PROCESSING PROCESS COORDINATION

 A management structure has been established by the Company to ensure compliance with the regulations of the KVK Law and the enforcement of the Personal Data Protection and Processing Policy.
The Information Security Committee has been assigned to manage this Policy and other policies related and related to this Policy within the Company in accordance with the decision of the senior management of the Company.
 The duties of this Committee regarding the protection of personal data are stated below:

• To prepare and put into effect the basic policies on the protection and processing of personal data and amendments, if necessary, and submit them to the approval of the senior management,
• To decide how the implementation and supervision of the policies on the protection and processing of personal data will be carried out and to submit the issues of making internal assignments and ensuring coordination within this framework to the approval of senior management,
• Determining the matters to be done to ensure compliance with the PDP Law and related legislation, submitting them to the approval of senior management, overseeing their implementation and ensuring their coordination,
• To raise awareness within the Company and the organizations with which the Company cooperates on the protection and processing of personal data,
• To identify the risks that may arise in the Company’s personal data processing activities, to ensure that necessary measures are taken, and to submit improvement proposals to the senior management for approval,
• To organize trainings on the protection of personal data and the implementation and dissemination of policies, to ensure that personal data owners are informed about personal data processing activities and their legal rights,
• To decide on the applications of personal data subjects at the highest level,
• To follow the developments and regulations on the protection of personal data and to receive suggestions on what needs to be done within the Company in accordance with these developments and regulations,
• Maintaining relations with the KVKK Board and the Authority,
• To perform other duties to be assigned by the senior management of the Company regarding the protection of personal data.

ANNEX-1 DEFINITIONS

 Explicit Consent: Consent regarding a specific subject, based on information and expressed with free will.
 Anonymization: It is the modification of personal data in such a way that it loses its personal data nature and this situation cannot be reversed. For example: Masking, aggregation, data corruption, etc. Making personal data impossible to be associated with a natural person by using techniques.
 Application Form: “Application Form Regarding Applications to be made to the Data Controller by the Relevant Person (Personal Data Owner) in accordance with the Law No. 6698 on the Protection of Personal Data”, which includes the application to be made by personal data owners to exercise their rights.
 Employee Candidate: Real persons who have applied for a job to the Company by any means or who have opened their resume and related information.
Employees, Shareholders and Authorities of Cooperating Organizations: Natural persons working in organizations with which the Company has any kind of business relationship (such as, but not limited to, business partners, suppliers), including the shareholders and officials of these organizations.
 Business Partner: Parties with whom the Company has established a business partnership for purposes such as carrying out various projects personally or together while conducting its commercial activities and receiving services.
 Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system.
 Personal Data Owner: The real person whose personal data is processed. For example; customer, staff, supplier employee
Personal Data: Any information relating to an identified or identifiable natural person. Therefore, the processing of information on legal entities is not covered by the Law. For example; name-surname, Turkish ID number, e-mail, address, date of birth, credit card number, etc.
Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
 Supplier: Parties that provide services to the Company on a contractual basis in accordance with the Company’s orders and instructions while carrying out the Company’s commercial activities.
 Third Party: Natural persons (e.g. family members, former employees) whose personal data are processed within the scope of the policy, who are not defined differently within the scope of the policy.
 Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller. For example, the cloud computing company that holds the Company’s data is
the Data Controller: The person who determines the purposes and means of processing personal data and manages the place where the data is kept systematically (data recording system). The Company is the data controller under this policy.
 Deletion of Data: It refers to the situation where all relevant users within the company are encrypted in a way that prevents access to personal data and only the data protection officer has this password.
 Destruction of Data: It refers to the situation where personal data is completely eliminated physically or by technological methods in a way that cannot be returned again.
 Visitor: Natural persons who have entered the physical premises owned by the Company for various purposes or who visit our websites.

DATA RESPONSIBLE

 Çağdaş Makina Import Export Industry Tic. Ltd. Sti.
 Address: Makine İhtisas O.S.B. 16. Sok. No:2 Dilovası / Kocaeli / Turkey
Uluçınar Data Department 2170390408
Mersis No: 0217039040800026
Telephone: +90 (262) 658 22 66 Fax: +90 (262) 658 22 76

INFORMATION SECURITY POLICY

 – Ensuring the confidentiality and integrity of the information of our company and its customers,
– Providing the necessary infrastructure to guarantee the continuity of our company’s services,
– Taking physical and logical security measures in accordance with the value of the information owned,
– Assigning access rights in accordance with the “need-to-know” principle to control access to information and preventing unauthorized access,
– Considering security needs when developing software, –
Protecting information assets against malicious codes such as viruses and attacks that may be made in cyber environment from outside the company,
– Developing a response process against information security incidents,
– Providing information security trainings to its employees and increasing information security awareness,
– Complying with laws and regulations,
– Ensuring compliance of stakeholders with our company’s Information Security Policies,
– Complying with the principles of secure system engineering,

PERMISSION TO USE COOKIES

 This website places cookies on the computer or mobile device you are using in order to improve the user experience and ensure the effective operation of the site. By continuing to use the site (by clicking, scrolling the page, turning off the cookie warning), you consent to the use of cookies. If you wish, you can restrict or completely prevent the receipt of this information by making the necessary settings.

PERSONAL DATA PROTECTION POLICY

 To process personal data in accordance with the law and honesty rules
To ensure the accuracy and timeliness of the personal data processed To
process personal data in a purpose-related, limited and measured manner To
keep personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed To ensure that
all our employees work with the awareness to take the necessary measures and pay attention to the Protection of Personal Data