Data Protection Notice for Employees

SIGMA (the “Company”), in its capacity as data controller, hereby informs you that your personal data, obtained by us in the manners specified below as the case may be, within the scope of our commercial relations or within our business relationship with you, will be recorded, stored, retained and reorganized, shared with institutions legally authorized to request such personal data, and, under the conditions stipulated by Law No. 6698 on the Protection of Personal Data (“KVKK”), transferred to third parties in Türkiye or abroad, assigned, classified and processed in the other manners listed in KVKK, within the framework of the purpose requiring their processing and in a manner connected with, limited to and proportionate to that purpose, while preserving the accuracy and most up-to-date version of the personal data as notified by you or to us.

YOUR PERSONAL DATA THAT MAY BE SUBJECT TO PROCESSING

By way of example, your personal data that may be subject to processing are as follows:

Identity Data	Name, surname, date of birth, country of birth, city of birth, gender, marital status, nationality, Turkish Republic identity card information (T.R. identity number, serial no., identity card no., father’s name, mother’s name, place of birth, province, district, neighbourhood, volume no., family serial no., serial no., household no., page no., registration no., place of issue, reason for issue, date of issue, previous surname), copy of identity card
Contact Data	Telephone number, full address, e-mail address, internal Company contact information (extension number, company line, corporate e-mail address, internet usage)
Financial Data	Financial and salary details, payrolls, bonus entitlements, bonus amounts, file and debt information relating to enforcement proceedings, bank passbook, minimum living allowance information, private health insurance amount
Special Categories of Personal Data	Trade union membership, former conviction status/criminal record, disability status/description/percentage, religion, health data, blood type, private health insurance policy, health reports, pre-employment health report, chest X-ray, hearing test, eye test, pre-employment and periodic examination forms signed at the request of the workplace physician, pregnancy status, pregnancy report, sick leave and maternity leave information, association/foundation memberships
Education Data	Educational background, certificate and diploma information, foreign language skills, training and skills, CV, courses attended
Visual and Audio Data	Photographs, voice recordings and camera recordings of the natural person
Employee Performance and Career Development Data	Training and skills, information on which training was received on which date, e-mail, signed attendance form, customer meeting quality assessment form, monthly performance evaluation and target achievement status, activity information
Family and Relatives Data	Marriage certificate; name, surname, T.R. identity number, gender, date of birth, height, weight, occupation and telephone number of spouse and children; name, surname and telephone number of relatives; family status declaration
Employment Data	Personnel registration no., position title, department and unit, title, latest date of employment, dates of employment and termination, social insurance enrolment/retirement, pension allocation no., social security no., TTF no., tax office no., flexible working hours status, travel status, Government Retirement Fund, Government Retirement Fund enrolment date, Government Retirement Fund registration no., Bağ-Kur enrolment date, Bağ-Kur registration no., accounting code, number of working days, projects worked on, total monthly working hours information, severance pay base date, severance pay additional days, days spent on strike
Leave Data	Leave seniority base date, leave seniority additional days, leave group, departure/return date, number of days, reason for leave, address/telephone while on leave
Other	Military service deferment, vehicle licence plate, copy of vehicle registration certificate, vehicle mileage information, vehicle location, copy of driving licence, traffic fine inquiry result, shoe size, clothing size, height, weight, status as a relative of a martyr, intern status, shuttle service used, shuttle stop used, employee internet access logs, entry and exit logs, head office entry-exit turnstile and fingerprint records, employee daily activity data

METHOD AND LEGAL GROUNDS FOR THE COLLECTION OF YOUR PERSONAL DATA

Pursuant to KVKK, where one of the conditions listed in the Law exists, personal data of a general nature may be processed without seeking your explicit consent. These conditions are:

It is expressly provided for by law,
It is necessary for the protection of the life or physical integrity of the person himself/herself or of another person, where the person is unable to express his/her consent due to actual impossibility or his/her consent is not deemed legally valid
It is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of that contract
It is necessary for the data controller to fulfil its legal obligation,
The data have been made public by the data subject himself/herself,
Data processing is necessary for the establishment, exercise or protection of a right
Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

In order to fulfil our legal obligations as an employer, we collect, physically or electronically and even without your explicit consent, your personal data which we request directly from you for the reasons stipulated by law and as required by the Company’s legitimate interest and the performance of the employment contract or other contracts, which you choose to share with us during or after your job application, or which are contained in other texts and documents forwarded to us by institutions and organizations. For example,

As required by the Company’s legitimate interest in monitoring work, and for the purposes of ensuring workplace security and fulfilling our legal obligations, we collect such data through systems that control entry and exit times (fingerprint, card reading).

Telephone equipment, e-mail addresses and internal company networks, together with the internet, are provided by the Company primarily for work-related tasks. These are work tools and Company resources. These tools must be used in accordance with legal regulations and the Company’s internal regulations. There is no general monitoring of telephone and e-mail communication or of internet use. In order to prevent attacks against the IT infrastructure or individual users, protective measures that block technically harmful content or analyse attack patterns are taken at points of access to the Company network. Records of the use of telephone equipment, e-mail addresses, the internet and/or internal company social networks are retained for a limited period for security reasons. Person-related evaluations of such data are carried out only where there is a concrete suspicion of a breach of legal regulations or company regulations. These checks are carried out by the relevant departments solely on condition that the principle of proportionality is observed.

As required by the Company’s legal obligation and legitimate interest in ensuring occupational health and workplace safety, we carry out video monitoring and recording through cameras installed in the workplace.

We may collect your photographs and images for the purposes of event management, in-house training, promotion and corporate communication activities.

In order to fulfil our legal obligation and because it is stipulated by law, we collect your health data physically or electronically through our workplace physician. Where our workplace physician is not available, we collect your data, by obtaining your explicit consent, for the purpose of forwarding it to the workplace physician.

PURPOSES OF PROCESSING YOUR PERSONAL DATA

Your personal data may be processed by the Company for the purposes and on the legal grounds set out below, as well as for similar purposes and reasons not limited thereto. Detailed information on the purposes for which your personal data are processed by our Company is available in the Personal Data Protection Policy made public on the website www.sigmamuhendislik.com.tr.

Fulfilment of the purpose necessary for the performance of the employment contract, in particular:

Approving employees’ leave, viewing remaining leave balances, making leave arrangements
Carrying out employees’ termination procedures
Ensuring that payroll transactions are carried out
Making salary payments to employees

In order to fulfil the requirements under the Labour Law, the Occupational Health and Safety Law, the Social Security Law and the relevant legislation, as well as other laws and legislation, in particular:

Creating the personnel file
Making notifications to the Social Security Institution (SGK) and the Turkish Employment Agency (İŞKUR), making police station notifications, and providing information on incentives and legal obligations
Ensuring the opening of a mandatory private pension insurance account
Determining the correspondence between camera recordings and door entry-exit records in order to check employees’ entry-exit records
Making payments to enforcement files in respect of salary garnishment deductions of employees
Making the statutory notifications of occupational accidents
Carrying out occupational health and safety procedures
Coordinating occupational health and safety training
Preparing emergency lists and conducting emergency operations
Preparing emergency analysis reports and carrying out the related notifications and investigations
Conducting the processes related to obtaining health reports from the workplace physician, collecting the reasons for sick reports, and assessing a change of position according to your state of health,
Conducting the pre-employment examination and subsequent periodic health check-ups
Complying with other information retention, reporting and notification obligations stipulated by legislation, relevant regulatory bodies and other authorities
Enforcing court decisions
Conducting life insurance, health insurance and private pension insurance operations, covering health expenses

In order to ensure security within the Company, in particular:

Ensuring workplace security
Ensuring the employee’s entry and exit

For the purposes of the administration of the Company, the conduct of business and the implementation of company policies, in particular:

Monitoring and reporting the performance of Company employees
Improving the quality of the products and services offered by the Company
Ensuring the legal and commercial security of our Company and of persons in a business relationship with our Company
Conducting disciplinary procedures
Determining and implementing our Company’s business strategies, conducting commercial activities
Making expense payments to employees
Managing personal advance and loan processes
Ensuring communication with employees
Verifying that an employee to whom a vehicle is allocated or made available is competent to drive and has not lost his/her driving licence for any reason
Providing vehicles to employees and arranging parking spaces
Arranging the printing of business cards
Ensuring that packages received via cargo and courier services are delivered to the relevant employee
Monitoring the use of Company vehicles for the safety of employees and the conduct of business
Arranging shuttle services and travel
Managing power of attorney and signature circular processes to be carried out in connection with representation and assignment within and outside the Company
Creating the employee’s business e-mail account by entering employee data into Outlook or a similar system
Conducting research projects concerning employees
Ensuring control of employees’ arrival at and departure from work
Recording employees’ documents collected during the job application and interview process
Ensuring communication for celebratory purposes
Planning training, reporting on training, preparing training certificates, monitoring the employees who attend training sessions, and monitoring employees’ development as a result of the training they receive
Ensuring quality control
Ensuring communication with the relevant persons in emergencies

Your personal data will be retained for the maximum period specified in the relevant legislation or required for the purpose for which they are processed and, in any event, for the duration of the statutory limitation periods.

SHARING OF YOUR PERSONAL DATA WITH DOMESTIC THIRD PARTIES

For your security and in order for our Company to fulfil its obligations under the law, your personal data may be shared with the relevant institutions or organizations to the extent permitted and required by the Labour Law, the Occupational Health and Safety Law, the Social Insurance and General Health Insurance Law, the Law on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, the Turkish Commercial Code, Law No. 6698 on the Protection of Personal Data, the Identity Notification Law and, without being limited thereto, other provisions of legislation; and with public legal entities such as the Personal Data Protection Authority, the Ministry of Finance, the Ministry of Customs and Trade, the Ministry of Labour and Social Security, the Turkish Employment Agency (İş-Kur) and the Information and Communication Technologies Authority, as well as with the institutions and organizations succeeding them. In addition, your personal data may be transferred to employees, officers, auditors and consultants, company shareholders, affiliates and group companies, business partners and service providers from whom we obtain services or with whom we cooperate in order to carry out the services or activities to be provided to you, and public institutions and organizations, for the purposes of the Company’s legitimate interests, the fulfilment of legal obligations, the performance of the contract, and the establishment, exercise and protection of a right.

Furthermore, as regards your personal data;

We may transfer payroll information to the Company’s auditors so that they can carry out their audit activities.
As required by the Company’s legal obligation and legitimate interest in ensuring workplace safety, we may share footage of occupational accidents and near misses with department managers, the OHS specialist, the general manager and company shareholders and, for illustrative purposes and subject to obtaining your explicit consent, with other employees of the workplace.

In order to fulfil our legal obligations, in particular:

We may share your personal data with our attorneys so that we can exercise our right of defence, and with the relevant institutions within the scope of our obligation to comply with legal requests such as court decisions or requests for evidence, provided that such requests are in accordance with law and procedure.

For the purposes of the administration of the Company, the conduct of business and the implementation of company policies, in particular:

We may transfer your personal data to the companies with which we are affiliated in order to ensure our internal operations with those companies.
We may transfer your personal data to archiving firms so that they can be stored throughout the retention periods, in order to preserve the Company’s data storage capacity.
Those of your personal data that are necessary may be transferred to the firm with which we work in the relevant matter for reasons such as transportation, vehicle supply, business card printing and car park registration.
We may transfer your personal data to firms acting as third parties, in particular the payroll firm, joint health and safety unit, insurance companies, healthcare institutions, brokerage firms, training companies, banks, travel agencies, software company, security firm, printing service companies, shuttle service firms, consultancy firms and bulk messaging service providers from which we receive services under contract or with which we cooperate.

SHARING OF YOUR PERSONAL DATA WITH THIRD PARTIES ABROAD

Your personal data may be shared with third parties abroad for the purposes of ensuring communication during business trips and training abroad, organizing travel, sending bulk e-mails, and informing company shareholders, affiliates, and the firms with which we are affiliated or with which we work jointly.

YOUR RIGHTS

Pursuant to Article 11 of KVKK, by applying to us in person and provided that you prove your identity, you have the following rights with respect to your personal data;

To learn whether the Company processes personal data about you and, if so, to request information in this regard,
To learn the purpose of processing your personal data and whether they are used in accordance with that purpose,
To learn whether personal data are transferred domestically or abroad and to whom they are transferred.

Furthermore, you have the right to request from the Company the rectification of your inaccurate or incomplete personal data and the notification of the recipients to whom your data have been or may have been transferred.

You may request the Company to destroy your personal data (to erase, destroy or anonymize them) within the framework of the conditions stipulated in Article 7 of KVKK. You may also request that the third parties to whom the data have been or may be transferred be informed of your destruction request. However, upon evaluating your destruction request, we will determine which method is appropriate according to the circumstances of the specific case. In this context, you may at any time request information from us as to why we chose the destruction method we selected.

You may object to the results of an analysis of your personal data generated exclusively by means of an automated system if such results are against your interests.

If you suffer damage due to the unlawful processing of your personal data, you may request compensation for such damage.

The requests contained in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, if the transaction entails an additional cost for the Company, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller.

You must submit your application concerning matters relating to the processing of your personal data to our Company by completing the application form available on the Company’s website www.sigmamuhendislik.com.tr and delivering it in person or through a notary public, or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or your e-mail address previously notified to us and kept in our records. Depending on the nature of your request and your method of application, the Company may request additional verification (such as sending a message to your registered telephone number or calling you) in order to determine whether the application belongs to you and thereby to protect your rights. For example, if you apply via your e-mail address registered with the Company, we may contact you using another contact method registered with the Company and request confirmation that the application belongs to you.

This notice is announced to all our employees for the purposes of information and disclosure.

Kind regards,

SIGMA