DATA PROTECTION AND PRIVACY POLICY (KVKK) DISCLOSURE
As Ceotherm Endüstriel Fırın İmalat San. ve Tic. Ltd. Şti. (“CEOTHERM” or “Company”), we prioritize the security of your personal data. Your personal data is processed, stored, and protected by CEOTHERM in accordance with the fundamental principles and conditions for the processing of personal data as stipulated in the Personal Data Protection Law No. 6698 (“KVKK”). We would like to inform you about the processing of your personal data and the measures we take to protect it with the utmost care.
1. Our Principles for Processing Personal Data
Your personal data is processed by us in line with the following principles:
a) Lawfulness and fairness,
b) Accuracy and, where necessary, being kept up to date,
c) Being processed for specified, explicit, and legitimate purposes,
d) Being relevant, limited, and proportionate to the purposes for which they are processed,
e) Being stored only for the period specified in the relevant legislation or as required for the purpose for which they are processed.
2. Obligation to Inform
Under Article 10 of the KVKK, data controllers are required to fulfill the obligation to inform data subjects when obtaining their consent for processing personal data. In this context, CEOTHERM, as the “data controller,” informs the “data subjects” about the following:
a) The identity of the data controller and, if applicable, its representative,
b) The purposes for which the personal data will be processed,
c) To whom and for what purposes the processed personal data may be transferred,
d) The methods and legal reasons for the collection of personal data,
e) The rights of the data subject under Article 11 of the KVKK.
This disclosure is made through this Privacy Policy (KVKK Aydınlatma Metni), and our explanations are provided below.
3. Identity of the Data Controller
According to Article 3/1 (ı) of the KVKK, a data controller is defined as “a natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.” In this context, the Company holds the status of a data controller, and the contact details of CEOTHERM for matters related to your personal data are as follows:
Ceotherm Endüstriel Fırın İmalat San. ve Tic. Ltd. Şti.
Address: Şekerpınar Mah. Marmara Geri Dönüşümcüler San. Sit. Ayçicek Sok No: 36 Çayırova, Kocaeli, Turkey
Email: info@ceotherm.com
Registered Email (KEP): ceotherm@hs02.kep.tr
Phone: +90(262) 658 1165
Fax: +90(262) 658 1115
4. Purposes and Conditions of Processing Personal Data
Your personal data is processed only if you give explicit consent or under the following legal grounds:
- It is explicitly provided for by the laws.
- It is necessary to protect the life or physical integrity of the person who is incapable of giving consent or whose consent is not legally valid.
- It is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.
- It is necessary for the data controller to fulfill its legal obligations.
- The data has been made public by the data subject.
- It is necessary for the establishment, exercise, or protection of a right.
- It is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Accordingly, personal data is processed by the Company for the performance of employment contracts with Company employees, for the legitimate interests of the Company in relation to employees, job candidates, and interns, and to fulfill the obligations arising from the Labor Law No. 4857, Turkish Code of Obligations No. 6098, Social Insurance and General Health Insurance Law No. 5510, and other relevant regulations.
Additionally, in relation to the operational activities of the Company, personal data of suppliers, dealers, contractors, intermediaries, joint venture partners, brokers, representatives, distributors, and other service providers involved in the Company’s business activities may be processed for the fulfillment of obligations arising from the Turkish Commercial Code No. 6102, the Turkish Code of Obligations No. 6098, and other relevant regulations.
For the avoidance of doubt, the processing of personal data by CEOTHERM includes the issuance of invoices and receipts for the purchase of goods and/or services from domestic or foreign sources, the execution of consultancy agreements with third parties, and the maintenance of records of legal proceedings involving the Company, during which personal data may be processed.
The processing of personal data for the above-mentioned purposes requires the explicit consent of data subjects, except in cases where obtaining consent is not legally required. In such cases, data processing is carried out in accordance with the conditions set forth in the law.
Under Article 6 of the KVKK, personal data that could result in discrimination and therefore require more sensitive protection are considered as special categories of personal data. These data include information related to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Among these, data related to health and sexual life can only be processed with explicit consent; other special categories of personal data, except for health and sexual life, can be processed without explicit consent only in cases prescribed by law.
For the purpose of public health protection, preventive medicine, medical diagnosis, treatment, and care services, health services and their financing and management, personal data relating to health and sexual life can be processed without explicit consent by persons or authorized institutions and organizations bound by confidentiality obligations.
The Company only processes health data and criminal records of employees and job candidates, such as medical reports required by law during the recruitment process, and no other special categories of personal data are processed.
5. Recipients and Purposes of Data Transfer
Your personal data may be shared with business partners, public legal entities, and judicial authorities within the scope of the purposes mentioned above and when required for the Company to fulfill its legal obligations.
Additionally, personal data obtained from employees and business partners may be transferred abroad to provide server services within the Company and to fulfill contractual obligations.
When sharing your personal data, CEOTHERM complies with the regulations in Articles 8 and 9 of the KVKK, and all necessary technical and administrative measures are taken to ensure data security during and after the transfer process.
According to Article 8 of the KVKK, personal data can be transferred to third parties without explicit consent if one of the conditions stated under “2. Processing Purposes” is met.
According to Article 9 of the KVKK, in addition to the above, for the transfer of personal data abroad, there must be adequate protection in the foreign country where the data is to be transferred. The countries providing adequate protection are determined by the Personal Data Protection Board (“Board”).
6. Rights of the Data Subject
As a data subject, you have the right to:
- Learn whether personal data is processed or not,
- Request information if personal data is processed,
- Learn the purpose of the processing and whether personal data is used in accordance with its purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request the correction of incomplete or inaccurate data,
- Request the deletion or destruction of personal data in accordance with Article 7 of the KVKK when the reasons for processing cease to exist,
Request notification of the correction or deletion to third parties to whom personal data has been transferred, - Object to the processing of personal data exclusively by automated systems that result in a negative consequence for the data subject,
- Request compensation for damages arising from the unlawful processing of personal data.
You can exercise these rights by submitting a request to the Company in writing or by other methods determined by the Board.
The Company will respond to your requests as soon as possible and within a maximum of thirty days, free of charge. However, if the process incurs an additional cost, the fee in the tariff set by the Board may be charged.
7. How Do We Protect Your Data?
All necessary technical and administrative measures are taken by the Company to prevent unauthorized access and to protect personal data collected and processed by the Company.
The Company ensures that the software used in its operations complies with standards, carefully selects third parties it collaborates with, authorizes employees in a well-defined manner, provides training to employees, and implements internal policies for data protection.
8. Right to Apply and Request Information
You can apply to the Company regarding your personal data in accordance with Article 11 of the KVKK using any of the following methods to exercise your rights mentioned above:
- By visiting the Company’s address in person with your identity and filling out the application form,
- By sending it via a notary public or registered mail to the Company’s address,
- By using a secure electronic signature, mobile signature, or the email address previously provided to the Company and registered in the Company’s system to the registered email address mentioned above,
- By filling out and submitting the application form on our website electronically.
In accordance with Article 13/2 of the KVKK, the Company will respond to your request within 30 (thirty) days from the date of receipt. The response will be delivered in writing or electronically. Please note that if the response exceeds ten pages, a fee of 1 Turkish Lira may be charged for each additional page. If the response is provided on a storage medium such as a CD or flash drive, the cost of the storage medium may be charged.
This translation aims to maintain the essence and clarity of the original document. If there are specific terms or sections that need further adaptation to align with legal requirements in English, please let me know!