Information and Clarification Text of the Personal Data Protection Law No.6698 (PDPL)
Our company, as a manufacturer and wholesaler in the automotive spare parts sector offers high-quality products under the "meha" brand to suppliers and end-users domestically and internationally. It is operating with the vision of being among the leading companies with the best service understanding in Turkey and worldwide.
Following the Personal Data Protection Law No.6698 (PDPL), we pay utmost importance to the processing and preservation of your personal data. All necessary technical and administrative measures to protect personal data, prevent the unlawful processing of personal data, and prevent unlawful access to personal data, have been taken.
Following Article 10 of the Law; we notify customers, suppliers, service providers, managers and employees, business partners, affiliates, company partners, personnel, employee candidates, interns, visitors, employees of public institutions and organizations and private law legal entities, and relevant third parties, about created policies and clarification text. This clarification text was prepared by MEHA METAL DÖKÜM SANAYİ TİCARET LİMİTED ŞİRKETİ (“Company”) in its capacity as data controller, following Article 10 of the Personal Data Protection Law No.6698 (1) ("Law") and the Communique On Principles And Procedures To Be Followed In Fulfillment Of The Obligation To Inform (2).
1. Data Controller
MEHA METAL DÖKÜM SANAYİ TİCARET LİMİTED ŞİRKETİ (Hasanağa Osb Mahallesi Hosab Sanayi Cad No:34 Nilüfer/BURSA/TURKEY, Tax Office: Çekirge, Tax number: 6130726384, Trade registration number: 76534, Central registration system number: 0613072638400011); processes personal data acting as “Data Controller” as defined in Article 3 of the Personal Data Protection Law No.6698.
2. What is the purpose of the processing personal data
Following PDPL No.6698, personal data which are shared with our company; wholly or partially by automated means or non-automated means, provided that they are part of a data recording system, recorded, stored, altered, adapted, are processed under the relevant legislation for the following purposes.
Accordingly, processed personal data are listed in below:
- Identity information (Turkish/Foreign Identity Number, name and surname, place and date of birth, mother's and father's name, marital status, gender, passport, family registration license, marriage license, driver's license, information provided on the vehicle license document, identity document or other identifying information from the identity sharing system)
- Contact information (residence address, phone number, e-mail address)
- Location information (information of your current location, address information)
- EDP Security (IP address, ID number, website login and logout information, passcode and password information)
- Personnel information (employment contract, education, diploma information, certificate information, SSI employment entry, notice of dismissal, GHI entry information, identity information written on the family status declaration, dependents, spouse, child proximity information, the identity registration information of family members, embezzlement certificate received according to the nature of the job, work certificate, resignation, termination, severance, and payment in lieu of notice, payroll information, disciplinary investigation information, SSI registry number, service scheme, resume information, leave information, personnel performance evaluation reports, work accident information, information in the job application form, references, information about the letter of recommendation, bank account information, IBAN number information)
- Information about legal operations (personal information in correspondence with judicial authorities, bank account information, case and enforcement files, information notified to lawyers, arbitral tribunals, mediators and relevant public institutions and organizations within this scope)
- Information about operating with customer, supplier, service providers (name, surname, Turkish identity number, identity information, address, e-mail, telephone, bank account information, check, warrant, payment, finance, authorized signatory list information)
- Physical space security information (customers, suppliers, service providers, managers and employees, company partners, group company's manager and employees, personnel, employee candidates, visitors' entrance and exit camera recording information, security entry-exit information kept in forms)
- Financial information (balance sheet information, financial performance information, credit and risk information, assets information, bank account information, information on customs procedures, personal information in foreign trade-related and notified forms)
- Information about work experience (education information, diploma information, working life, reference information, courses attended, in-service training information, certificates, driver's license information, other information kept in forms)
- Visual records (photo information on filled, printed forms, documents and official identity documents, photos taken when necessary within the scope of job application and company activities, in fairs, advertisements, marketing events, company campaigns, website, social media accounts or third-party social media channels, shared photos, your images in camera recordings)
- Health information (health status information of employees and employee candidates written in the job application form, health reports of employees, periodic examination information, medication information, blood group, personal health and physical disability status information, medical board report)
- Information about criminal conviction and security measures (criminal record, conviction, judicial status information)
- Appearance and clothing information (height, weight, size number of clothing, footwear number)
- Risk management data (personal data collected by the company during business operation, vehicle license, trade registry information)
- User name, password, other personal information added to the system, electronically recorded on the company's website.
- Information about complaints or requests submitted through the website, social media accounts, or call services and the actions taken during the evaluation and management of the process
- Information obtained through corporate call services, personal information obtained by e-mail, letter, or other communication tools
- Personal data shared directly or indirectly with our company, limited to company activities, are processed and protected following the Personal Data Protection Law No.6698 and the applicable legislation. Personal data processing purposes have been determined by our company in the following articles.
- Your personal data will be processed following conditions and purposes determined in Articles 4, 5 and 6 of the Law. Personal data will not be used for any purpose other than the company's activities.
3. To whom and for what purposes processed personal data can be transferred
Personal data processed by our company can be transferred to natural or legal persons following Articles 8 and 9 of Law No.6698 for the purposes listed below. Accordingly;
4. Data transfer abroad
Personal data can be transferred following Article 4/2 of the Personal Data Protection Law and by obtaining the explicit consent text about processing of personal data, to be collected individually from employees, employee candidates, customers and suppliers, service providers, and visitors, or as specified in Articles 5/2, 6/3 of the Law, without obtaining explicit consent, following rules in Article 9, only to persons and organizations residing in foreign countries with sufficient protection declared by the Personal Data Protection Board (“Board”) and countries where it is determined and declared that there is no adequate protection, it can be transferred, provided that data controllers in Turkey and in the relevant foreign country undertake an adequate protection in writing, and to be limited by obtaining necessary permission from the Personal Data Protection Board regarding the relevant transfer. In this context, your personal information may be transferred abroad within the scope of your legal relationship and activity with our Institution, within the limits provided by the Law No.6698.
5. Methods and legal reasons for collecting personal data
The personal data of the above-mentioned persons are collected and processed within the scope of company activities, limited to the stated purposes, under the legal regulations. In the automotive spare parts sector, which is our company's field of activity, within the scope of producing rubber-to-metal, rubber, and flywheel products and offering these products under the brand "MEHA AUTOMOTIVE", we collect, process, store, and notify your personal data by filling in the documents that are required and mandatory, for you to benefit from our products and services.
Your personal data are processed and collected in our company's buildings and premises, website, social media accounts, third-party websites' call centers. In addition, data are collected if you use the company building and its premises and the company parking area, through camera systems that take images and records to ensure the indoor and outdoor security of the company. Personal data, wholly or partially, by automated means or non-automated means, provided that they are part of any data recording system, are collected, processed, and stored in electronic and physical media.
Personal data from the contracts made with our company, the records kept on the internet, the application forms, employees and the employee candidates, the personal data written in the application form, and the documents required for the personal file, received for the continuation of the human resource business operations for the interns, financial information received for the establishment and maintenance of accounting, financial and social rights, personal data processed for purchasing, marketing, planning, quality and corporate development, personal information forms processed in training, personal information processed by filling in surveys, training forms, job application forms, electronically held data or image records, and personal data collected with the card through electronic automation systems to monitor the attendance of the employees; are collected and processed within the scope of the legislation and legal reasons listed below.
For our company to carry out the necessary activities and processes, personal data; International regulations, Constitution, Code of Obligations, Labor Law, Turkish Commercial Code, Tax procedural law and related financial legislation, Customs Law, Customs Regulation, Foreign Trade Legislation, Turkish Criminal Law, Turkish Code of criminal procedure, Law on the regulation of publications on the internet and suppression of crimes committed by means of such publications, Regulation of the procedures and principles regarding the law on the regulation of publications on the internet, Regulation on the privacy and handling of personal health data, Law on the regulation of electronic commerce, Electronic signature law, Electronic communication law, Regulation on the processing of personal data and protection of confidentiality in the electronic communication sector, Regulation on service providers and intermediary service providers in electronic commerce, Regulation on commercial communication and commercial electronic messages, Law of police powers, Turkish statistical law, Social security institution law, Law regarding the prevention of laundering of crime revenues, Regulation on trade registry, Regulation on private employment offices, Regulation on internet sites to be opened by companies with shared capital, Communiqué on processes and technical criteria related to the registered electronic mail system, Regulation on internal systems of banks; collected in accordance with the relevant legislation, laws, regulations and communiqués in force and in accordance with the legal reasons specified in Articles 5 and 6 of the Law No.6698.
By rule, your personal data are processed based on the explicit consent of the person concerned. However, in the presence of one of the personal data processing conditions stated below, it is possible to process personal data without obtaining the explicit consent of the subject:
With this policy, personal data processed within the scope of our company's activities are kept and stored for the periods specified by our company according to the nature of the processed personal data, as specified in the Personal Data Storage and Disposal Policy prepared by our company, for the period specified in the relevant legislation.
6. Ownership rights over personal data (The Right to petition)
Following Article 11 of the Personal Data Protection Law No.6698 "Rights of The Data Subject", petition shall be delivered to the data controller, MEHA METAL DÖKÜM SANAYİ TİCARET LİMİTED ŞİRKETİ, Hasanağa Osb Mahallesi Hosab Sanayi Cad No:34 Nilüfer / BURSA / TÜRKİYE according to the Communiqué on the procedures and principles of the petition to the data controller (3), with attached APPLICATION FORM, filled in by the Personal Data Owner and by personally sending a signed copy of the form to the company address together with the identity documents, or by sending an e-mail to [email protected] using a secure electronic signature, mobile signature or the e-mail address you have notified to our company and registered in our company system, or by sending an e-mail to our company's registered e-mail address (KEP) [email protected], using the personal registered e-mail address (KEP) of the related person, or by personal application through a public notary, or by the methods determined by the Personal Data Protection Institution.
Following Article 11 of the Law; in relation to themselves, everyone, by applying to the data controller;
- Developing the company's products and services, continue corporate development activities
- To sell products to the company's customers to relevant institutions and organizations, to continue commercial activities and service procurement transactions with third parties.
- To continue the company's finance and accounting business
- Planning and executing human resources business operations, fulfilling job and internship application processes, creating personnel files, fulfilling financial obligations
- Making and executing the contracts and protocols that the company has made or will make with its customers, dealers, suppliers, employees, and related third parties with whom it has legal relations.
- Continuing advertising and marketing activities
- To provide communication and conversation with natural and legal persons with whom the company has legal relations.
- To ensure the corporate quality of the company, to ensure security of the related persons.
- To carry out the work and transactions, processes before the Personal Data Protection Institution within the scope of the Personal Data Protection Law,
- Following the legislation; to make necessary legal notifications to the relevant public institutions and organizations, to fulfill legal obligations within the scope of company activities
- The company's obligation to proof the evidence in legal disputes of the company with third parties
- Ensuring corporate and personal development through participation in training, seminars, or events organized by the company
- To continue the necessary processes for using our website concerning company activities, to use the company's contact information for communication, to fill in the forms on our website
- Ensuring the security of the company buildings and premises and control of entrances and exits to the company buildings and premises.
- Enabling customers and related third parties to benefit from our products and services by logging into the system via the company website
- Making and tracking domestic and international sales transactions related to our products and services, management of the shipment process, customs procedures, transactions related to the foreign trade process, payment through banks or by check, promissory note, credit card, other commercial payment methods, provide the receipt
- To carry out company activities and fulfill mutual obligations; to our customers, suppliers, service providers, affiliates, business partners, performance assistants, and subcontractors
- Revenue Administration, Tax Offices, SSI, relevant public institutions, and organizations to fulfill the legal obligations defined in the relevant legislation.
- To fulfill the occupational health and safety operations of the related persons, within the scope of occupational health and safety measures, the health information of the employees is submitted to the persons and organizations from which the relevant health services are received, and to the insurance companies.
- To banks, financial institutions, public and private legal persons, public officials for carrying out the financial transactions of the related persons.
- In matters of public security and legal disputes, upon request and limited to the purpose of the legislation, to prosecutors' offices, courts, enforcement offices, and relevant legal institutions and organizations
- To software, hardware, information, and technology companies in Turkey and abroad to install computer operating systems and computer programs used within our company, and to carry out maintenance and repair operations of the programs.
- Transferred to technology companies to ensure the security of electronic data belonging to the company.
- In the case of transferring sensitive personal data in the country, by obtaining the explicit consent of the related person, sensitive personal data other than health and sexual life may be transferred to the relevant third parties in cases defined by the laws. In addition to the above-mentioned groups of persons, personal data are transferred to our company's employees, company partners, legal, financial, and tax consultants, customs administration, customs consultancy, auditors, public institutions such as BRSA (Banking Regulation and Supervision Agency), FCIB (Financial Crimes Investigation Board), ministries, authorized public institutions and organizations such as judicial authorities, relevant persons and organizations that we are in contact with for foreign trade transactions, the person permitted by the provisions of the payment service legislation in accordance with the legislation and limited to the purpose of the transfer.
- It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of contracts between our Company and third natural and legal persons
- Obligatory for the company to fulfill its legal obligations
- The personal data has been made public by the related person
- Data processing is mandatory for the establishment, exercise, or protection of the Right
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the related person.
- Since it is clearly defined in the laws
Following Article 13/1 of the PDPL No.6698, you must submit your applications in writing or through the above-mentioned methods determined by the PDP Institution to exercise your above-mentioned rights. Our company will conclude your requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board will be charged. In this context, if the application of the related person is answered in writing, no fee will be charged for up to ten pages, and a processing fee of 1 TL will be charged for each page above ten pages. If the response to the application is given in an electronic recording medium such as CD or flash memory, the fee that may be requested by our company will not exceed the cost required for the recording medium.
- Learning whether personal data is processed or not,
- If it has been processed, requesting information on personal data
- Learning the purpose of processing personal data and whether they are used in accordance with its purpose,
- To know the third parties to whom personal data are transferred in the country or abroad,
- Requesting alteration of personal data in case of incomplete or incorrect processing,
- Requesting the deletion or destruction of personal data within the framework of the conditions defined in Article 7 of the PDPL,
- In case of alternation, deletion or destruction of personal data, requesting to notify third parties to whom personal data has been transferred,
- Objecting to the result against the person himself by analyzing processed data exclusively through automated systems
- The right to demand compensation for the damage in case of loss due to the unlawful processing of personal data.