POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA UNDER LAW NO. 6698
KVKK.25 | First Publication Date: 22.12.2019 | Revision No: 00 | Revision Date: —
Section 1. Purpose and Effect of the Policy
The Personal Data Protection Law No. 6698 (“Law”) entered into force on 7 April 2016. The Law sets out the procedures and principles governing the processing of personal data by natural or legal persons who are classified as the “data controller,” who determine the purposes and means of processing personal data, and who are responsible for establishing and managing the data recording system.
Under the Law, personal data is defined as “any information relating to an identified or identifiable natural person,” and processing is defined as “any operation performed upon personal data, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or preventing the use of the data, wholly or partially by automated means, or by non-automated means provided that it forms part of a data recording system.”
Among other provisions, the Law imposes an obligation on data controllers to inform / notify data subjects whose personal data is being collected. Under Article 10 of the Law, data controllers must inform data subjects of:
- The identity of the data controller and its representative, if any,
- The purpose for which personal data will be processed,
- To whom and for what purpose the processed personal data may be transferred,
- The method and legal basis for collecting personal data,
- The other rights listed in Article 11 of the Law.
This document (“KVKK Policy”) has been prepared in order to inform, within the scope of the article referred to above, the natural persons whose personal data is processed by Forplas Plastik San. ve Tic. A.Ş. in its capacity as data controller. The subject of this Policy covers the officers and employees of Forplas Plastik San. ve Tic. A.Ş., its customers, the shareholders, officers, and employees of our business partners and suppliers, our job candidates, former employees and interns, persons who have retired from Forplas Plastik San. ve Tic. A.Ş., our visitors, our prospective business partners and suppliers, and other third parties; matters relating to the processing of personal data of our employees are regulated under a separate policy provided to employees in accordance with the Law.
Section 2. Scope of the Law and the Rights and Obligations of Forplas Plastik San. ve Tic. A.Ş. Arising from the Law
I. General Principles Relating to the Processing of Personal Data
Pursuant to Article 4 of the Law, personal data must be processed in accordance with the procedures and principles set out in the Law and other applicable legislation. In this context, data controllers are obliged to comply with the following general principles regarding the processing of personal data, in addition to fulfilling the notification obligation described in Section 1 above:
- Being lawful and in accordance with the rules of good faith.
- Being accurate and, where necessary, kept up to date.
- Being processed for specified, explicit, and legitimate purposes.
- Being relevant, limited, and proportionate to the purposes for which they are processed.
- Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
II. Purposes of Processing and Sharing Personal Data Under the Law
a. Purposes of Processing Personal Data
Under the Law, personal data may not, as a rule, be processed without the explicit consent of the data subject. However, under Articles 5 and 6, the Law sets out a number of circumstances in which personal data and special categories of personal data may be processed without explicit consent.
- Pursuant to this article, personal data,
- Where data processing is expressly permitted by law,
- Where processing of the data of a person who is unable to disclose consent due to actual impossibility, or whose consent is not legally valid, is mandatory to protect the life or physical integrity of that person or another person,
- Where it is necessary to process personal data belonging to parties to a contract, provided that this is directly related to the establishment or performance of that contract,
- Where data processing is mandatory for the data controller to fulfil its legal obligations,
- Where the personal data has been made public by the data subject themselves,
- Where data processing is mandatory for the establishment, exercise, or protection of a right,
- Where data processing is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject — in such cases, data may be processed even without the data subject’s prior explicit consent (provided that the required notification has been made).
On the other hand, the Law defines data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data, as “special category” or “sensitive” personal data, and imposes stricter conditions for their processing. Accordingly, special categories of personal data may only be processed, other than in cases where explicit consent has been obtained from the data subject, under the following conditions:
- Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal conviction and security measures, as well as biometric and genetic data, may be processed in the cases stipulated by law.
- Personal data relating to health and sexual life may only be processed, subject to a duty of confidentiality, by persons or authorized public institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.
b. Purposes of Sharing Personal Data
In line with the conditions for processing, the sharing (transfer) of personal data with a third party is likewise subject to the explicit consent of the relevant data subject. However, under Article 8 of the Law, data may also be transferred under the conditions that permit data processing; accordingly, where the conditions set out in Section 2.II.a above are met, personal data or special categories of personal data may be transferred even without the data subject’s consent.
The Law subjects the transfer of personal data abroad to third parties to special conditions. Accordingly, personal data may be transferred abroad;
- Where the data subject has given explicit consent, or
- Where the data subject has not given explicit consent but one or more of the other conditions set out above are met; in this case, transfer abroad is permitted if there is adequate protection in the country to which the data is transferred, or, if there is no adequate protection in that country, provided that the data controller and the data controller in the relevant foreign country jointly undertake in writing to provide adequate protection and the permission of the Personal Data Protection Board is obtained.
III. Matters Falling Outside the Scope of the Law
Pursuant to Article 28 of the Law, the Law shall not apply in the following cases:
- Processing of personal data by natural persons wholly within the scope of activities relating to themselves or family members living in the same household, provided that the data is not disclosed to third parties and data security obligations are complied with.
- Processing of personal data for purposes such as research, planning, and statistics by anonymizing it with official statistics.
- Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, the confidentiality of private life, or personal rights, and does not constitute a crime.
- Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized and empowered by law to ensure national defense, national security, public security, public order, or economic security.
- Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, adjudication, or execution proceedings.
Section 3. Processing of Personal Data by Forplas Plastik San. ve Tic. A.Ş.
I. Categorization of Personal Data Processed by Forplas Plastik San. ve Tic. A.Ş.
Forplas Plastik San. ve Tic. A.Ş. processes personal data under the categories defined below:
| Data Category | Description of the Personal Data Category |
|---|---|
| Identity Information | Information contained in documents such as a driver’s license, national ID card, residence permit, passport, bar association ID, or marriage certificate (e.g. national ID number, passport number, ID serial number, full name, photograph, place of birth, date of birth, age, place of registration, family registry record) |
| Contact Information | Information used to contact a person (e.g. email address, telephone number, mobile phone number, address) |
| Location Data | Data used to determine the location of the data subject (e.g. location data obtained during vehicle use) |
| Customer Information | Information belonging to customers who benefit from our products and services (e.g. customer number, occupation information, etc.) |
| Customer Transaction Information | Information relating to any transaction carried out by customers who benefit from our products and services (e.g. requests and instructions, order and basket information, etc.) |
| Physical Space Security Information | Personal data relating to records and documents obtained upon entry to, and while remaining within, a physical space (e.g. entry-exit logs, visit information, camera records, etc.) |
| Transaction Security Information | Personal data processed to ensure the technical, administrative, legal, and commercial security of Forplas Plastik San. ve Tic. A.Ş. and relevant parties (e.g. information such as website passwords that link a transaction to the data subject and demonstrate that they were authorized to carry it out) |
| Risk Management Information | Personal data processed to manage our company’s commercial, technical, and administrative risks (e.g. IP address, MAC ID, and similar records) |
| Financial Information | Personal data within the scope of information, documents, and records showing any financial outcome created according to the type of legal relationship with the data subject (e.g. information showing the financial outcome of the data subject’s transactions, credit amount, card information, credit payments, interest amount and rate payable, debit balance, credit balance, etc.) |
| Personnel Records Information | Personal data forming the basis of the personnel rights of Forplas Plastik San. ve Tic. A.Ş. employees (any information and document legally required to be included in a personnel file) |
| Job Candidate Information | Personal data used in the application evaluation process, belonging to data subjects who share their information in order to apply for a job at Forplas Plastik San. ve Tic. A.Ş. (e.g. CV, interview notes, personality test results, etc.) |
| Employee Transaction Information | Personal data relating to any work-related transaction carried out by Forplas Plastik San. ve Tic. A.Ş. employees (e.g. entry-exit records, business trips, information relating to meetings attended, security screening, email traffic monitoring information, vehicle usage information, company card expenditure information) |
| Employee Performance and Career Development Information | Personal data processed to measure the performance of Forplas Plastik San. ve Tic. A.Ş. employees and to plan and carry out their career development within the scope of human resources policies (e.g. performance evaluation reports, interview results, career development training) |
| Fringe Benefits Information | Personal data processed to track the fringe benefits offered to Forplas Plastik San. ve Tic. A.Ş. employees and to enable supplier employees to benefit from them (e.g. private health insurance, vehicle allocation) |
| Marketing Information | Data to be used by Forplas Plastik San. ve Tic. A.Ş. in marketing activities (e.g. reports and assessments showing a person’s habits and preferences, collected for marketing purposes, targeting information, cookie records, data enrichment activities) |
| Legal Proceedings and Compliance Information | Personal data processed for the establishment and pursuit of legal claims and rights and the fulfilment of debts and legal obligations (e.g. data contained in documents such as court and administrative authority decisions) |
| Audit and Inspection Information | Personal data processed within the scope of Forplas Plastik San. ve Tic. A.Ş.‘s compliance with its legal obligations and policies (e.g. audit and inspection reports, related interview records, and similar records) |
| Special Category Personal Data | Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data |
| Request/Complaint Management Information | Personal data relating to the receipt and evaluation of any request or complaint directed at Forplas Plastik San. ve Tic. A.Ş. (e.g. requests and complaints, and related records and reports) |
| Visual and Audio Data | Visual and audio records associated with the data subject (e.g. photographs, camera recordings, and audio recordings) |
II. Purposes for Which Personal Data Is Processed by Forplas Plastik San. ve Tic. A.Ş.
Forplas Plastik San. ve Tic. A.Ş. processes personal data within the scope described above for the following purposes:
- Planning, auditing, and execution of information security processes
- Establishment and management of the information technology infrastructure
- Planning and execution of fringe benefits for employees
- Planning and/or execution of corporate communications with employees and/or corporate social responsibility and/or civil society activities in which employees participate
- Monitoring and/or supervision of employees’ work activities
- Tracking of finance and/or accounting matters
- Tracking of legal matters
- Planning of human resources processes
- Carrying out and planning of effectiveness/efficiency and/or appropriateness analyses of activities
- Planning and execution of activities
- Planning and execution of business partners’ and/or suppliers’ access authorizations to information
- Management of relationships with business partners and/or suppliers
- Planning and/or execution of occupational health and/or safety processes
- Planning and/or execution of business continuity activities
- Planning and execution of corporate communication activities
- Planning and execution of corporate governance activities
- Planning and execution of logistics activities
- Planning and execution of customer relationship management processes
- Planning and/or execution of customer satisfaction activities
- Tracking of customer requests and/or complaints
- Execution of personnel recruitment processes
- Fulfilment of obligations arising from the employment contract and/or legislation for Forplas Plastik San. ve Tic. A.Ş. employees
- Planning and execution of Forplas Plastik San. ve Tic. A.Ş. audit activities
- Planning and execution of external training activities
- Planning and execution of the operational activities necessary to ensure that Forplas Plastik San. ve Tic. A.Ş.‘s activities and procedures are carried out in accordance with the relevant legislation
- Planning and/or execution of internal training activities at Forplas Plastik San. ve Tic. A.Ş.
- Planning and execution of internal orientation activities at Forplas Plastik San. ve Tic. A.Ş.
- Ensuring the security of Forplas Plastik San. ve Tic. A.Ş.‘s business area and/or facilities
- Planning and/or execution of processes to create and/or increase loyalty to the services offered by Forplas Plastik San. ve Tic. A.Ş.
- Tracking of contract processes and/or legal claims
- Execution of strategic planning activities
- Planning and execution of supply chain management processes
- Wage management
- Ensuring that data is accurate and up to date
- Providing information to authorized institutions as required by legislation
- Creation and tracking of visitor records
III. Transfer of Personal Data by Forplas Plastik San. ve Tic. A.Ş. and Categorization of Parties to Whom Data Is Transferred
Personal data may be transferred by Forplas Plastik San. ve Tic. A.Ş., for the purposes stated above, to our authorized personnel, affiliates, business partners, suppliers, legally authorized public institutions and organizations, and private institutions.
IV. Procedure for Processing Personal Data by Forplas Plastik San. ve Tic. A.Ş.
In its capacity as data controller, Forplas Plastik San. ve Tic. A.Ş. informs data subjects in accordance with Article 10 of the Law before collecting their personal data, within the scope of its obligations under the Law. Where any data processing activity carried out by Forplas Plastik San. ve Tic. A.Ş. does not meet the conditions set out in the Law and detailed in Sections 2.II.a and b above, the explicit consent of data subjects is obtained, and the relevant processes are carried out within the framework of that explicit consent.
Under the Law, explicit consent is defined as “consent relating to a specific matter, based on information, and expressed with free will”; accordingly, Forplas Plastik San. ve Tic. A.Ş. obtains the explicit consent of data subjects after informing them in accordance with Article 10 of the Law.
Although the Law does not set a specific period for the retention of personal data, the general principle is that personal data must be retained for the period stipulated in the relevant legislation or required for the purpose for which it is processed. In order to determine retention periods in accordance with this principle, Forplas Plastik San. ve Tic. A.Ş. conducts an assessment for each data processing activity based on the legislation in force and the purpose of the process. Accordingly, Forplas Plastik San. ve Tic. A.Ş. retains personal data for at least the period required by its legal obligations, and in any event until the relevant statute-of-limitations periods have expired.
Forplas Plastik San. ve Tic. A.Ş. anonymizes, deletes, or destroys personal data in accordance with the Law once the purpose of processing that data no longer applies within the scope of any process, including upon the expiry of the periods referred to above.
V. Personal Data Security
Forplas Plastik San. ve Tic. A.Ş. takes reasonable technical and administrative measures to ensure the security of personal data and to prevent the risk of unauthorized access, accidental data loss, and the intentional deletion of or damage to data. In this context, we take at least the following actions:
- Taking appropriate software and hardware security measures for the personal data processed
- Carrying out the audits stipulated under the Law
- Ensuring employees’ compliance with the Law through internal training and procedures at Forplas Plastik San. ve Tic. A.Ş.
- Ensuring and recording access to information on a need-to-know basis through internal authorizations at Forplas Plastik San. ve Tic. A.Ş.
- Monitoring personal data processing activities on a process basis
- Obtaining contractual undertakings relating to the protection and security of personal data in relationships with suppliers
Section 4. Rights of Data Subjects Under the Law
I. Rights of Data Subjects
Under Article 11 of the Law, personal data subjects have the right to:
- Learn whether their personal data is being processed,
- Request information about it if their personal data has been processed,
- Learn the purpose for which their personal data is processed and whether it is used in accordance with that purpose,
- Know the third parties to whom their personal data is transferred, whether domestically or abroad,
- Request the correction of their personal data if it has been processed incompletely or incorrectly,
- Request the deletion or destruction of their personal data if, despite having been processed in accordance with the Law and other applicable legislation, the reasons requiring its processing no longer exist,
- Request that any correction, deletion, or destruction carried out as a result of the above be notified to third parties to whom the personal data has been transferred,
- Object to a result that is to their detriment arising solely from the analysis of processed data exclusively through automated systems,
- Claim compensation for damages if they suffer loss due to the unlawful processing of their personal data.
Article 28, paragraph 2 of the Law provides that, in certain cases, data subjects may not make any request from the data controller other than for compensation for damages. Accordingly,
- Where processing personal data is necessary for the prevention of a crime or for a criminal investigation,
- Where personal data made public by the data subject themselves is processed,
- Where processing personal data is necessary for authorized public institutions and organizations and professional bodies with public institution status, acting under legal authority, to carry out audit or regulatory duties, or for disciplinary investigation or prosecution,
- Where processing personal data is necessary to protect the state’s economic and financial interests in relation to budgetary, tax, and financial matters, the rights listed above may not be exercised with respect to the relevant data.
II. Exercising These Rights
Data subjects may use the Application Form to exercise the rights referred to above.
Applications may be submitted, together with documents identifying the relevant data subject, by delivering a wet-signed copy of the form in person or via a notary public, or through the other methods specified in the Law — to Forplas Plastik San. ve Tic. A.Ş. at Köseler Mahallesi 18. Cadde No:21/0, Dilovası – Kocaeli – Türkiye, or by sending a registered email to info@forplas.com.tr, or by email sent from an email address previously notified to and registered in the systems of Forplas Plastik San. ve Tic. A.Ş. If the Personal Data Protection Board prescribes a method other than those referred to above, applications may also be submitted using that method.
Requests from data subjects submitted through one of the methods listed above are evaluated and answered by Forplas Plastik San. ve Tic. A.Ş. within thirty days at the latest. Forplas Plastik San. ve Tic. A.Ş. reserves the right to request additional information and documents from the applicant, in particular to verify that the applicant is the relevant data subject.
Applications from data subjects are, as a rule, evaluated free of charge by Forplas Plastik San. ve Tic. A.Ş. However, if a fee is set by the Personal Data Protection Board in relation to the data subject’s request, our Company shall be entitled to request payment based on that fee.