General Data Protection Regulation

Clarification Text Regarding the Processing of Personal Data

Data Supervisor: Atasu Su ve Su Ürünleri Gıda Turizm San.ve Tic. A.Ş.

Çamlıca Mahallesi İstiklal Caddesi  No:207 Hendek / Sakarya

We, as Atasu Su ve Su Ürünleri Gıda Turizm San.ve Tic. A.Ş.(ATASU); have prepared this clarification letter regarding the processing, storage and transfer of your personal data within the framework of the activities arising from the “Personal Data Protection Law” (KVKK) No. 6698, relevant legislation and legal regulations in order to inform you;

Our employees,

Our employee candidates,

Our interns,

Product and service buyers,

Dealer related persons,

Supplier related staff,

and our visitors.

Which of your Personal Data is Collected for What Purpose?

Employees

•   Identity Information

■  Name, Surname, Gender, Nationality, T.R. Identity Number/Foreign Identity Number, Date of Birth, Place of Birth, Marital Status, Identity Card/Copy of Identity Card, Driver’s License Number, Photocopy of Driver’s License, Signature.

■ Purpose of processing personal data; Fulfillment of Employment Contract and Legislation Obligations for Employees, Execution of Benefits and Benefits Processes for Employees, Execution of Audit / Ethical Activities, Execution of Training Activities, Execution of Wage Policy, Execution of Activities in Compliance with the Legislation, Execution of Finance and Accounting Affairs, Employee Satisfaction and Loyalty Processes Execution, Execution of Talent / Career Development Activities, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Management Activities, Execution of Communication Activities, Planning of Human Resources Processes, Execution / Supervision of Business Activities, Execution of Occupational Health / Safety Activities, Execution of Contract Processes, Performance Evaluation Execution of the Processes, Execution of Storage and Archive Activities, Ensuring the Security of Movable Property and Resources, Execution of Legal Affairs, Ensuring Physical Space Security, Execution of Access Authorities Execution of Emergency Management Processes.

•      Contact Information

■ Home Phone Number, Mobile Phone Number, Residence Certificate (Residence Document), Residence address.

■ Purpose of processing personal data; Execution of Communication Activities, Planning of Human Resources Processes, Execution of Training Activities, Execution of Wage Policy, Execution of Occupational Health and Safety Activities, Execution of Emergency Activities, Execution / Supervision of Business Activities, Informing Authorized Persons, Institutions and Organizations, Execution of Management Activities, Legal Affairs Execution, Execution of Access Authorities, Execution of Contract Processes.

•      Financial Information

■ Information in the Scope of AGI (Minimum Living Allowance), Bank Account Information, Information on Disability Tax Exemption.

■ Purpose of processing personal data; Fulfillment of Obligations Originated from Employment Contract and Legislation for Employees, Execution of Benefits and Benefits Processes for Employees, Execution of Wage Policy, Execution of Activities in Compliance with the Legislation, Execution of Finance and Accounting Affairs, Planning of Human Resources Processes, Execution / Audit of Business Activities.

•      Personal Information

■ Position/title information, Work history and details, Curriculum vitae, Educational status, Official correspondence about the employee, SGK employment statement, SGK leave notice, Leave (administrative and annual leave), Photograph, Documents showing military status, Insurance data, Reference Name, Surname, Reference Institution Name and Position, Reference Telephone Number.

■ Purpose of processing personal data; Fulfillment of Obligations arising from Employment Contract and Legislation for Employees, Execution of Benefits and Benefits Processes for Employees, Execution of Training Activities, Follow-up and Execution of Legal Affairs, Planning of Human Resources Processes, Execution of Occupational Health / Safety Activities, Execution of Contract Processes, Execution of Wage Policy, Foreign Personnel Work and Residence Permit Transactions, Providing Information to Authorized Persons, Institutions and Organizations, Ensuring Legal Transaction Security, Establishment and Management of the Registry

•      Professional Experience Information

■ Diplomas and certificates

■ Purpose of processing personal data; Fulfillment of Obligations Originated from Employment Contract and Legislation for Employees, Execution of Benefits and Benefits Processes for Employees, Execution of Training Activities, Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Planning of Human Resources Processes, Execution / Audit of Business Activities , Execution of Occupational Health / Safety Activities, Ensuring Business Continuity Activities, Organization and Event Management, Execution of Performance Evaluation Processes, Execution of Storage and Archive Activities, Establishment and Management of the Registry, Execution of Contract Processes, Execution of Wage Policy, Foreign Personnel Work and Residence Permit Transactions , Execution of Management Activities

•      Health Information

■ Health report (employment admission), Periodic examination report, Disability report, Health reports, Health information (including reports received for dangerous jobs and medical history regarding occupational diseases).

■ Purpose of processing personal data; Fulfillment of Obligations Originated from Employment Contract and Legislation for Employees, Execution of Benefits Processes for Employees, Execution of Contract Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Assignment Processes, Execution / Audit of Business Activities, Execution of Occupational Health / Safety Activities Conducting Business Continuity Activities, Providing Information to Authorized Persons, Institutions and Organizations.

•      Process Security Records

■ Internal IP Address, Destination IP/Domain Records, External IP Address, Sim Card IMSI Number, Electronic Access/Activity Records, Other Traffic Data (eg connection time/duration, communication amount etc.).

■ Purpose of processing personal data; Execution of Information Security Processes, Ensuring Business Continuity Activities, Execution of Audit / Ethical Activities, Execution of Access Authorities, Execution of Activities in Compliance with the Legislation, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Communication Activities Execution / Audit of Business Activities, Execution / Audit of Business Activities, Storage And Execution of Archive Activities, Giving Information to Authorized Persons, Institutions and Organizations.

•      Physical Place Security Records

■ CCTV Records

■ Purpose of processing personal data; Execution of Information Security Processes, Execution of Audit / Ethical Activities, Execution of Activities in Compliance with the Legislation, Ensuring Physical Space Safety, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Occupational Health / Safety Activities, Execution of Risk Management Processes, Execution of Storage and Archive Activities, Authorized Person Giving Information to Institutions and Organizations, Execution of Management Activities.

•      Criminal Conviction and Security Measures

■ Information on Criminal Records, Criminal convictions and security measures.

■   Purpose of processing personal data;Execution / Supervision of Business Activities, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Giving Information to Authorized Persons, Institutions and Organizations, Execution of Contract Processes, Execution of Assignment Processes.

•     Information Belongs To Family Members

■ Names and surnames of family members, Marital status, Number of children, Contact information of family members, Photocopy of marriage certificate.

■ Purpose of processing personal data; Execution of Wage Policy, Fulfillment of Obligations arising from Employment Contract and Legislation for Employees, Execution of Benefits and Benefits Processes for Employees, Execution of Activities in Compliance with Legislation, Execution of Finance and Accounting Affairs, Providing Information to Authorized Persons, Institutions and Organizations

•      Legal Processing Information

■ Correspondence with judicial authorities, Correspondence with administrative authorities, Information in the case file, Information within the scope of the Notice and Warning.

■ Purpose of processing personal data; Follow-up and Execution of Legal Affairs, Execution of Contract Processes, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Audit Ethical Activities, Execution of Activities in Compliance with the Legislation, Fulfillment of Employee Contracts and Obligations arising from the Legislation, Carrying out Storage and Archive Activities.

•     Audio-Visual Recordings

■ Photo Recordings, Video Recordings.

■ Purpose of processing personal data; Execution of Training Activities, Execution of Talent/Career Development Activities, Execution of Marketing Processes of Products/Services, Organization and Event Management, Execution/Control of Business Activities.

Employee Candidates

 

•     Identity Information

■ Name, surname, T.R. identification number/foreign identity number, date of issue of driver’s license, driver’s license class, date of birth, military service certificate, signature.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidates’ Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Communication Activities.

•     Contact Information

■ Email address, residential address, home phone number, mobile phone number.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidates’ Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Communication Activities.

•     Personal Information

■ Work history and details, Educational status, Curriculum vitae, Reference information.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidates’ Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Communication Activities.

•     Reference Information

■ Name, Surname, Telephone Number, Department, Title, Reference Type.

■ Purpose of processing personal data; Carrying out the Application Processes of the Employee Candidates, Planning the Human Resources Processes, In order to carry out the human resources activities for the applied position, To carry out the human resources activities for the positions that may be opened in the future;

•     Physical Place Security Records

■ CCTV records.

■ Purpose of processing personal data; Execution of Information Security Processes, Execution of Audit / Ethical Activities, Execution of Activities in Compliance with the Legislation, Ensuring Physical Space Safety, Execution of Occupational Health / Safety Activities, Providing Information to Authorized Persons, Institutions and Organizations.

 

 

 

Interns

•     Identity Information

■ Name, Surname, T.R. Identity Number, Photograph, Signature, Copy of Identity Card, Place of Birth, Gender, Marital Status, Date of Birth.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Fulfillment of Obligations Originated from Employment Contract and Legislation for Employees, Execution of Training Activities, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution / Supervision of Business Activities, Execution of Contract Processes, Authorized Person, Providing Information to Institutions and Organizations, Execution of Access Authorities.

•     Contact Information

■ Phone Number, Email Address.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Training Activities, Execution of Activities in Compliance with the Legislation, Execution of Communication Activities, Execution / Supervision of Business Activities, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Communication Activities, Execution of Access Authorities.

•     Personal Information

■ Internship information, SGK (Social Security Institution) employment certificate, Compulsory Internship Document (Internship Start Form), School information, Educational Status.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Providing Information to Authorized Persons, Institutions and Organizations, Planning Human Resources Processes, Execution / Supervision of Business Activities, Execution of Occupational Health / Safety Activities, Execution of Talent / Career Development Activities, Storage and Archive Activities Execution, Execution of Activities in Compliance with the Legislation.

•     Financial Information

■ Bank Account Information

■ Purpose of processing personal data; Fulfillment of Employment Contract and Legislation Obligations for Employees, Execution of Finance and Accounting Affairs, Planning of Human Resources Processes, Execution / Supervision of Business Activities, Execution and Audit of Business Activities.

•       Physical Place Security Records

■ CCTV Records, Physical access entry and exit records.

■ Purpose of processing personal data; Ensuring the Security of Movable Property and Resources, Execution of Activities in Compliance with the Legislation, Providing Physical Space Safety, Execution of Occupational Health / Safety Activities.

•     Information About School Officials

■ Name, Surname, Business Phone Number, Signature.

■ Purpose of processing personal data; Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Activities in Compliance with the Legislation, Execution of Communication Activities, Planning of Human Resources Processes, Execution / Supervision of Business Activities, Execution of Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations.

•     Legal Process Information

■ Correspondence with administrative authorities.

■ Purpose of processing personal data; Providing Information to Authorized Persons, Institutions and Organizations, Execution of Storage and Archive Activities, Follow-up and Execution of Legal Affairs.

•     Process Security Records

■ Internal IP Address, External IP Address, Destination IP/Domain Registers, Electronic Access/Activity Logs, Other Traffic Data (eg connection time/duration, amount of communication etc.)

■ Purpose of processing personal data; Execution of Information Security Processes, Execution of Audit / Ethical Activities, Execution of Access Authorizations, Execution of Activities in Compliance with the Legislation, Execution / Control of Business Activities, Execution of Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations.

 

Product and Service Buyer

 

•      Identity Information

■ Name, Surname

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Supervision of Business Activities, Receiving and Evaluation of Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Services After-Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Services Production and Operation Processes, ,  Conducting Marketing Analysis Studies,

•     Contact Information

■ Phone Number, Address

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Supervision of Business Activities, Receive and Evaluation of Suggestions for the Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Services After-Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Services Production and Operation Processes, ,  Conducting Marketing Analysis Studies,

•      Customer Process Information

■ Call center records, Order Information, Request Information

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Supervision of Business Activities, Receiving and Evaluation of Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Services After-Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Services Production and Operation Processes, ,  Conducting Marketing Analysis Studies

 

 

Dealer Information

•      Identity Number

■ Name, Surname, T.R. Identification Number

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Audit of Business Activities, Receiving and Evaluation of Suggestions for the Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Contract Processes, Execution of Activities in Compliance with the Legislation, Execution of Finance and Accounting Works, Execution of After Sales Support Services for Goods / Services, Execution of Service Sales Processes, Execution of Goods / Services Production and Operation Processes, Execution of Marketing Analysis Studies,

•      Contact Information

■ Phone Number, Address

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Supervision of Business Activities, Receiving and Evaluation of Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Services After-Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Services Production and Operation Processes, Conducting Marketing Analysis Studies,

•      Financial Information

■ Bank Account Information

■ Purpose of processing personal data; Execution of Finance and Accounting Affairs, Execution / Audit of Business Activities, Execution of Contract Processes

 

 

Supplier Related Staff

•      dentification Number

■ Name, Surname, T.R. Identification Number

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Audit of Business Activities, Receiving and Evaluation of Suggestions for the Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Contract Processes, Execution of Activities in Compliance with the Legislation, Execution of Finance and Accounting Works, Execution of After Sales Support Services for Goods / Services, Goods / Execution of Service Sales Processes, Execution of Goods / Services Production and Operation Processes,   Execution of Marketing Analysis Studies,

•      Contact Information

■ Phone Number, Address

■ Purpose of processing personal data; Execution of Communication Activities, Execution / Supervision of Business Activities, Receiving and Evaluation of Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Goods / Services After-Sales Support Services, Execution of Goods / Service Sales Processes, Execution of Goods / Services Production and Operation Processes, ,  execution of supply chain management processes, Execution of Marketing Analysis Studies

•      Financial Information

■ Bank Account Information

■ Purpose of processing personal data; Execution of Finance and Accounting Affairs, Execution / Audit of Business Activities, Execution of Contract Processes

Visitors

 

•       Physical Place Security Records

■ CCTV Records, Physical access entry and exit records.

■ Purpose of processing personal data; Execution of Information Security Processes, Execution of Audit / Ethical Activities, Execution of Activities in Compliance with the Legislation, Ensuring Physical Space Safety, Execution of Occupational Health / Safety Activities, Providing Information to Authorized Persons, Institutions and Organizations.

The personal data processing process is carried out by ATASU, by obtaining the explicit consent of the persons in the data processing processes, which do not fall within the scope of the above-mentioned purposes and where the “explicit consent of the relevant person” is required as per the KVKK (Kişisel Verileri Koruma Kanunu – Personal Data Protection Law) and related legal regulations.

What are the Collection Methods of Your Personal Data?

Your personal data specified above in categories; application forms, employment contract, contracts, curriculum vitae, electronic tracking and physical access control systems in the workplace (card pass systems, CCTV), information systems and electronic devices (e.g. telecommunication infrastructure, computers and telephones), İŞKUR and private employment offices (including Kariyer.net, etc.), online website, Cookies/Cookies created by our own website, declared in call center calls, mobile application, Tracking Cookies/Tracking Cookies created by third parties (eg Hotjar), site usage measurement systems (eg Google Analytics) and other documents and statements declared by the person concerned (in physical and electronic media).

What is the Legal Reason for Collecting Your Personal Data?

Your personal data, processed by ATASU; In line with the realization of the above-mentioned purposes, within the scope of the establishment of the contract, its expressly stipulated in the laws, the allocation of rights, the fulfillment of our legal responsibilities and our legitimate interests in accordance with the relevant legislation, especially the Turkish Commercial Code, Labor Law, Turkish Code of Obligations and KVKK (Kişisel Verileri Koruma Kanunu – Personal Data Protection Law) regulations.

Do We Transfer Your Personal Data to a Third Party?

Your personal data,

  • Is shared within the scope of the legal regulation, for the purposes of executing the activities in accordance with the legislation, following and executing the legal affairs, informing the authorized persons, institutions and organizations, fulfilling the obligations arising from the employment contract and legislation for the employees, conducting / auditing the business activities and carrying out the occupational health / safety activities. to Authorized Public Institutions and Organizations, and
  • Is shared within the scope of the legal regulation, it can be transferred to Real Persons or Private Law Legal Entities in the country for the purpose of carrying out the activities in accordance with the legislation and informing the authorized persons, institutions and organizations.

What Are Your Rights Regarding Your Personal Data?

The rights you have regarding your personal data;

  • Learning whether your personal data is processed or not,
  • If your personal data has been processed, requesting information about it,
  • Learning the purpose of processing personal data and whether they are used in accordance with the purpose,,
  • Knowing the third parties to whom your personal data is transferred, in the country or abroad,
  • Requesting correction of your personal data if it is incomplete or incorrectly processed,
  • Requesting the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK (Kişisel Verileri Koruma Kanunu – Personal Data Protection Law) legislation,
  • When you request the deletion or destruction of your personal data with the correction of incomplete or inaccurate data, requesting that this situation be notified to the third parties to whom we have transferred your personal data,
  • If you suffer damage due to unlawful processing of personal data, requesting the removal of this damage.

How Can You Exercise Your Rights?

If the relevant person wishes to request his/her personal data through Relevant Person Application Form ;
  • With wet signature and a copy of the identity card, Atasu Su ve Su Ürünleri Gıda Turizm San.ve Tic. Inc. By sending it to Çamlıca Mahallesi Istiklal  Cadresi No:207 Hendek / Sakarya address,
  • By personally applying to ATASU with a valid identity document,
  • By sending it to our registered e-mail address atasuvesuurunleri@hs01.kep.tr  using a registered e-mail (KEP) address and secure electronic signature or mobile signature,
  • By sending email from the email address which previously registered to ATASU system by the relevant person to our  kvkk@elmaciksu.com.tr email address.
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, the name, surname, signature if the application is in writing, T.C. identification number, (passport number if the applicant is a foreigner), domicile or workplace address for notification, e-mail address for notification, if any, telephone number and fax number, and information on the subject of the request. The Relevant Person must clearly and comprehensibly state the subject requested in the application, which includes explanations regarding the right to be exercised and requested to use the above-mentioned rights. Information and documents related to the application must be attached to the application. Although the subject of the request must be related to the person of the applicant, if acting on behalf of someone else, the applicant must be specifically authorized in this regard and this authority must be documented (special power of attorney). In addition, the application must include identity and address information, and documents confirming identity must be attached to the application. Requests made by unauthorized third parties on behalf of someone else will not be considered.

How Long Will Your Requests Regarding the Processing of Your Personal Data Be Answered?

Your claims regarding your personal data are evaluated and answered within 30 days at the latest from the date they reach us. In case your application is evaluated negatively, the reasons for rejection are sent to the address you specified in the application, by e-mail or postal mail, in particular, by one of the methods selected in the Relevant Person Application Form.