Personal Data Protection Policy

INTRODUCTION 

The protection of personal data is among the values and policies to which our company attaches institutional importance. The most important part of this matter consists of the protection and processing, as governed by this Policy, of the personal data of customers, prospective customers, our interns, company shareholders, company officers, our visitors, the employees, shareholders and officers of the institutions that are our business partners, our suppliers, third parties and our employees (data subjects).  

Pursuant to Article 20 of the Constitution of the Republic of Türkiye, all natural persons have the right to request the protection of personal data concerning them. With respect to the protection of personal data, which is a constitutional right, our company exercises the necessary care to protect the data of data subjects and has made this a company policy.  

Within this scope, the necessary administrative and technical measures are taken by our company for the protection of personal data processed in accordance with the relevant legislation.  

This Policy provides detailed explanations regarding the fundamental principles listed below, which our company has adopted in the processing of personal data:  

1. Processing personal data lawfully and in accordance with the rules of good faith, 
2. Keeping personal data accurate and, where necessary, up to date, 
3. Processing personal data for specified, explicit and legitimate purposes, 
4. Processing personal data in a manner that is relevant, limited and proportionate to the purposes for which they are processed, 
5. Retaining personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed, 
6. Informing and notifying data subjects, 
7. Establishing the necessary system for data subjects to exercise their rights, 
8. Taking the necessary measures for the retention of personal data, 
9. Acting in compliance with the relevant legislation and the regulations of the Personal Data Protection Board in transferring personal data to third parties in line with the requirements of the processing purpose, 
10. Exercising the necessary sensitivity in the processing and protection of special categories of personal data.

PURPOSE OF THE POLICY  

The main purpose of this Policy is to provide explanations regarding the personal data processing activities carried out lawfully by our company and the systems adopted for the protection of personal data, and in this context, to ensure transparency and openness by informing the persons whose personal data are processed by our company, in particular customers, prospective customers, our interns, company shareholders, company officers, our visitors, the employees, shareholders and officers of the institutions that are our business partners, our suppliers, third parties and our employees.  

SCOPE  

This Policy relates to all personal data of customers, prospective customers, our interns, company shareholders, company officers, our visitors, the employees, shareholders and officers of the institutions that are our business partners, our suppliers, third parties and our employees that are processed by automated means or by non-automated means provided that they form part of a data recording system.  

The scope of application of this Policy with respect to the groups of data subjects in the categories specified above may be the entire Policy or only some of its provisions.  

PRINCIPLES OF IMPLEMENTATION OF THE POLICY  

The relevant legal regulations in force regarding the processing and protection of personal data shall apply in the first instance. In the event of any inconsistency between the legislation in force and the Policy, our Company accepts that the legislation in force shall prevail.  

The Policy has been created by setting out and putting into concrete form, within the scope of our company’s practices, the rules laid down by Law No. 6698 on the Protection of Personal Data (“KVKK”). Our Company is carrying out the necessary systems and preparations in order to act in compliance with the effective periods stipulated in the KVKK.  

1. PRINCIPLES OF IMPLEMENTATION FOR THE PROTECTION OF PERSONAL DATA 

In accordance with Article 12 of the KVKK, our Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of the personal data it processes, to prevent unlawful access to the data and to ensure the retention of the data, and within this scope conducts or has conducted the necessary audits.  

1. 2.      ENSURING THE SECURITY OF PERSONAL DATA 

Our Company takes the necessary legal, technical and administrative measures regarding data security in the matters specified below and exercises the utmost attention and care in this respect. The actions and measures taken by our Company to ensure “data security” pursuant to Article 12 of the KVKK are set out below.  

1. Our Company takes technical and administrative measures, according to technological possibilities and the cost of implementation, to ensure that personal data are processed lawfully. Employees are informed that they may not disclose the personal data they learn to others in violation of the provisions of the KVKK or use them for purposes other than processing, and that this obligation will continue after they leave their positions, and the necessary undertakings are obtained from them accordingly.
2. Our Company takes technical and administrative measures, according to the nature of the data to be protected, technological possibilities and the cost of implementation, in order to prevent the inadvertent or unauthorized disclosure of, access to or transfer of personal data, or any other form of unlawful access. 
3. Our Company raises awareness among data processing institutions to which it has transferred personal data, such as business partners and suppliers, regarding the prevention of unlawful processing of personal data, the prevention of unlawful access to data and the lawful retention of data; and takes the necessary measures to ensure that business partners and suppliers carry out personal data processing activities in compliance with the KVKK. 
4. The obligations that our Company must comply with as a data controller when processing personal data, and the obligation to comply with the legal, administrative and technical measures it has developed in this respect, are legally imposed on the data processing institutions with which our Company has relations in various capacities, such as supplier or business partner, through updates made to contracts in a manner consistent with the nature of the activity they carry out with respect to data processing. 
5. Our Company takes the necessary technical and administrative measures, according to technological possibilities and the cost of implementation, to ensure that personal data are stored in secure environments and to prevent their destruction, loss or alteration for unlawful purposes. 
6. In accordance with Article 12 of the KVKK, our Company conducts or has conducted the necessary audits within its own organization. The results of these audits are reported to the relevant department within the scope of the Company’s internal operations, and the necessary activities are carried out to improve the measures taken. 
7. In accordance with Article 12 of the KVKK, our Company operates a system ensuring that, in the event that the personal data processed are obtained by others through unlawful means, this situation is notified to the relevant data subject and to the Personal Data Protection Board as soon as possible.  
8. 3. OBSERVING THE RIGHTS OF THE DATA SUBJECT AND EVALUATING THEIR REQUESTS  

In accordance with Article 13 of the KVKK, our Company operates the necessary channels, internal procedures, and administrative and technical arrangements for evaluating the rights of data subjects and providing the necessary information to data subjects.  

Where data subjects submit their requests regarding the rights listed below to our Company in writing, our Company concludes the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the tariff determined by the Board will be charged to the applicant by our Company. Data subjects have the rights to;  

1. Learn whether personal data are processed, 
2. Request information if personal data have been processed, 
3. Learn the purpose of processing of personal data and whether they are used in accordance with their purpose, 
4. Know the third parties to whom personal data are transferred domestically or abroad, 
5. Request the rectification of personal data if they have been processed incompletely or inaccurately, and request that the transaction carried out in this context be notified to the third parties to whom the personal data have been transferred, 
6. Request the erasure or destruction of personal data in the event that the reasons requiring their processing cease to exist, even though they have been processed in compliance with the KVKK and the provisions of other relevant laws, and request that the transaction carried out in this context be notified to the third parties to whom the personal data have been transferred, 
7. Object to the occurrence of a result to the detriment of the person through the analysis of the processed data exclusively by means of automated systems, 
8. Claim compensation for damages in the event of suffering damage due to the unlawful processing of personal data, 

as listed above.  

Pursuant to paragraph 1 of Article 13 of the Law on the Protection of Personal Data, data subjects are required to submit their requests regarding the exercise of the rights specified above to our Company in writing or by other methods determined by the Personal Data Protection Board.  

Submitting their requests to our Company together with the information necessary to establish their identity and explanations regarding the rights they wish to exercise, and also indicating which of the rights set out in Article 11 of the Law the request relates to, will enable applications by data subjects to exercise the rights specified above to be answered more quickly and effectively.  

In this context, the channels and procedures through which applications to be made to our Company in writing, based on Article 13 of the Law on the Protection of Personal Data, within the scope of the exercise of the rights set out in Article 11 of the same Law specified above, will be submitted are explained below. 

You are required to submit your application regarding matters related to the processing of your personal data to our Company by filling in the application form available on the Company’s website, either in person or by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature or your e-mail address previously notified to us and registered in our records. Depending on the nature of your request and your method of application, additional verifications (such as sending a message to your registered telephone number or calling you) may be requested by the Company in order to determine whether the application belongs to you and thereby to protect your rights. For example, if you apply via your e-mail address registered with the Company, we may contact you using another contact method registered with the Company and ask for confirmation of whether the application belongs to you.  

In order for third parties to submit an application on behalf of data subjects, there must be a special power of attorney issued through a notary public by the data subject in the name of the person who will make the application.  

1. 4.      PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA  

Under the KVKK, special importance has been attributed to certain personal data due to the risk of causing victimization or discrimination of persons when processed unlawfully. 

These data are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.  

Our Company acts with sensitivity in the protection of special categories of personal data that are designated as “special categories” under the KVKK and are processed lawfully. In this context, the technical and administrative measures taken by our Company for the protection of personal data are carefully implemented with respect to special categories of personal data, and the necessary audits are ensured.  

1. 5.      INFORMING THE DATA SUBJECT  

In accordance with Article 10 of the KVKK, our Company informs data subjects at the time personal data are obtained. In this context, at the time their personal data are obtained, our Company informs data subjects of the identity of our Company, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of personal data collection, and the rights the data subject has under Article 11 of the KVKK.  

Article 20 of the Constitution sets forth that everyone has the right to be informed about personal data concerning them. Accordingly, “requesting information” is also listed among the rights of the data subject in Article 11 of the KVKK. In this context, our Company provides the necessary information in the event that the data subject requests information, in accordance with Article 20 of the Constitution and Article 11 of the KVKK.  

In addition, by announcing to data subjects and relevant persons, through various publicly available documents, in particular this Policy document, that it carries out personal data processing activities in compliance with all matters in the KVKK and in particular the rule of “lawfulness and good faith”, our Company informs relevant persons about its personal data processing activities and thereby ensures accountability and transparency. Furthermore, our Company also informs data subjects through many different methods about its own activities and the matters set out in the law, in particular when it seeks their “explicit consent”.  

2. PROCESSING OF PERSONAL DATA  

In accordance with Article 20 of the Constitution and Article 4 of the KVKK, our Company carries out personal data processing activities lawfully and in accordance with the rules of good faith; accurately and, where necessary, up to date; pursuing specified, explicit and legitimate purposes; and in a manner that is relevant, limited and proportionate to the purpose. Our Company retains personal data for the period stipulated by law or required by the purpose of personal data processing.  

Pursuant to Article 20 of the Constitution and Article 5 of the KVKK, our Company processes personal data on the basis of one or more of the conditions for the processing of personal data set out in Article 5 of the KVKK. 

In accordance with Article 6 of the KVKK, our Company acts in compliance with the regulations stipulated for the processing of special categories of personal data.

In accordance with Articles 8 and 9 of the KVKK, our Company acts in compliance with the regulations stipulated in the law and laid down by the Personal Data Protection Board regarding the transfer of personal data.  

Processing of Employee Data 

Processing of data for the employment relationship  

In employment relationships, personal data are processed without obtaining separate consent where this is necessary for the establishment, performance and termination of the employment contract. The personal data of candidates are processed when initiating an employment relationship. If a candidate is rejected, the candidate’s information is retained for an appropriate data retention period for a subsequent selection stage, and at the end of this period it is erased, destroyed or anonymized.

Data processing carried out because it is expressly stipulated by law or due to the Company’s legal obligation 

Personal data of employees may be processed without obtaining separate consent where the processing is expressly provided for in the relevant legislation or for the purpose of fulfilling a legal obligation determined by the legislation.

Processing of data in accordance with legitimate interest 

Personal data of employees may also be processed without obtaining separate consent where required by a legitimate interest of the Company. Legitimate interests are generally legal (e.g. the filing, enforcement or defence of legal claims) or economic (e.g. the valuation of the company) interests. In personal circumstances where the interests of employees need to be protected, personal data are not processed for legitimate interest purposes. Before data are processed, it is determined whether there are interests requiring protection. When employee data are processed on the basis of the Company’s legitimate interest, it is examined whether the processing is proportionate. It is checked that the Company’s legitimate interest in taking this control measure does not infringe a right of the relevant employee that needs to be protected, and the measure is applied only if it is proportionate.

Telecommunications and the internet  

Telephone equipment, e-mail addresses and in-house networks, together with the internet, are provided by the Company primarily for work-related tasks. These are work tools and Company resources. These tools must be used in compliance with legal regulations and the Company’s internal regulations. There is no general monitoring of telephone and e-mail communications or internet use. In order to prevent attacks against the IT infrastructure or individual users, protective measures are taken at the points of access to the Company network that block technically harmful content or analyze the patterns of attacks. The usage of telephone equipment, e-mail addresses, the internet and/or in-house social networks is stored for a limited period for security reasons. Person-specific evaluations of these data are carried out only where there is a concrete suspicion of a violation of legal regulations or company regulations. These checks are carried out by the relevant departments only on condition that the principle of proportionality is observed.  

2.1. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION  

Processing in Accordance with the Law and the Rule of Good Faith  

Our Company acts in accordance with the principles introduced by legal regulations and the general rule of trust and good faith in the processing of personal data. In this context, our Company takes into account the requirements of proportionality in the processing of personal data and does not use personal data beyond what the purpose requires.  

Ensuring that Personal Data Are Accurate and, Where Necessary, Up to Date  

Taking into account the fundamental rights of data subjects and its own legitimate interests, our Company ensures that the personal data it processes are accurate and up to date. It takes the necessary measures to this end.  

Processing for Specified, Explicit and Legitimate Purposes  

Our Company clearly and precisely determines the legitimate and lawful purpose of personal data processing. Our Company processes personal data in connection with the services it provides and to the extent necessary for them. The purpose for which personal data will be processed by our Company is set out before the personal data processing activity begins. 

Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed  

Our Company processes personal data in a manner suitable for the achievement of the specified purposes and refrains from processing personal data that are not relevant to or not needed for the achievement of the purpose. For example, no personal data processing activity is carried out to meet needs that may arise later.  

Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which They Are Processed  

Our Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context, our Company first determines whether a period is stipulated in the relevant legislation for the retention of personal data; if a period has been determined, it acts in accordance with that period, and if no period has been determined, it retains personal data for the period required for the purpose for which they are processed. Upon the expiry of the period or the cessation of the reasons requiring processing, personal data are erased, destroyed, subjected to destruction processes or anonymized by our Company.  

2.2.      LIMITED PROCESSING OF PERSONAL DATA  

Pursuant to the third paragraph of Article 20 of the Constitution, personal data may be processed only in the cases stipulated by law or with the explicit consent of the person. Accordingly, and in compliance with the Constitution, our Company processes personal data only in the cases stipulated by law or with the explicit consent of the person.  

The data subject’s giving of explicit consent is only one of the legal bases that make it possible to process personal data lawfully. Apart from explicit consent, personal data may also be processed where one of the other conditions written below exists. The basis of a personal data processing activity may be only one of the conditions specified below, or more than one of these conditions may form the basis of the same personal data processing activity. If the processed data are special categories of personal data, the conditions below apply.  

Although the legal bases for the processing of personal data by our Company may differ, in every kind of personal data processing activity our Company acts in accordance with the general principles set out in Article 4 of Law No. 6698.  

Existence of the Explicit Consent of the Data Subject  

One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the data subject must be given on a specific matter, on an informed basis and with free will.  In order for personal data to be processed on the basis of the data subject’s explicit consent, the explicit consent of employees, customers, potential customers, visitors and other third parties is obtained through the relevant methods.  

Being Expressly Stipulated by Law  

The personal data of the data subject may be processed lawfully where expressly stipulated by law.  

Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility  

The personal data of the data subject may be processed where the processing of personal data is mandatory to protect the life or physical integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent cannot be deemed valid.  

Being Directly Related to the Establishment or Performance of a Contract  

Personal data may be processed where it is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of the contract.  

Fulfilment of the Company’s Legal Obligation  

The personal data of the data subject may be processed where processing is mandatory for our Company, as data controller, to fulfil its legal obligations.  

The Data Subject Having Made Their Personal Data Public  

Where the data subject has made their personal data public, the relevant personal data may be processed.  

Data Processing Being Mandatory for the Establishment or Protection of a Right  

The personal data of the data subject may be processed where data processing is mandatory for the establishment, exercise or protection of a right.  

Data Processing Being Mandatory for the Legitimate Interest of Our Company  

The personal data of the data subject may be processed where data processing is mandatory for the legitimate interests of our Company, provided that this does not harm the fundamental rights and freedoms of the data subject.  

2.3.      PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA  

In the processing of personal data designated as “special categories” under the KVKK, our Company acts with sensitivity in compliance with the regulations stipulated in the KVKK.  

In Article 6 of the KVKK, certain personal data that carry the risk of causing victimization or discrimination of persons when processed unlawfully have been designated as “special categories”. These data are data relating to race, ethnic origin, political party membership, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.  

In compliance with the KVKK, special categories of personal data are processed by our Company in the following cases, provided that adequate measures to be determined by the Personal Data Protection Board are taken:  

1. If the data subject has given explicit consent, or 
2. If the data subject has not given explicit consent; 
3. Special categories of personal data other than those relating to the health and sexual life of the data subject are processed in the cases stipulated by law,
4. Special categories of personal data relating to the health and sexual life of the data subject are processed only by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, medical diagnosis, the conduct of treatment and care services, and the planning and management of health services and their financing.  

2.4.      TRANSFER OF PERSONAL DATA  

In line with lawful personal data processing purposes, our Company may transfer the personal data and special categories of personal data of the data subject to third parties (business partners and other third parties) by taking the necessary security measures. Accordingly, our Company acts in compliance with the regulations stipulated in Article 8 of the KVKK.  

Transfer of Personal Data Abroad  

In line with lawful personal data processing purposes, our Company may transfer the personal data and special categories of personal data of the data subject to third parties abroad by taking the necessary security measures. Personal data are transferred by our Company to foreign countries declared by the Personal Data Protection Board to have adequate protection (“Foreign Country with Adequate Protection”) or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and in the relevant foreign country have undertaken adequate protection in writing and where the permission of the Personal Data Protection Board exists (“Foreign Country Where a Data Controller Undertaking Adequate Protection Is Located”). Accordingly, our Company acts in compliance with the regulations stipulated in Article 9 of the KVKK.  

3. PURPOSES AND PERIODS OF PROCESSING OF DATA 

In accordance with Article 10 of the KVKK, within the scope of the obligation to inform, our Company notifies the data subject of which personal data of which groups of data subjects it processes, the purposes of processing the data subject’s personal data and the retention periods.  

3.1.      CATEGORIZATION OF PERSONAL DATA  

Within our Company, personal data are processed in line with our Company’s legitimate and lawful personal data processing purposes, based on and limited to one or more of the personal data processing conditions set out in Article 5 of the KVKK, in compliance with the general principles set out in the KVKK, in particular the principles regarding the processing of personal data set out in Article 4, and with all obligations regulated in the KVKK, limited to the periods within the scope of this Policy, and by informing the data subjects pursuant to Article 10 of the KVKK.  

3.2.      PURPOSES OF PROCESSING OF PERSONAL DATA  

The Company processes personal data limited to the purposes and conditions within the personal data processing conditions set out in paragraph 2 of Article 5 and paragraph 3 of Article 6 of the KVKK. These purposes and conditions are;  

1. With regard to the processing of personal data, the relevant activity of SIGMA being expressly stipulated by law 
2. The processing of personal data by SIGMA being directly related to and necessary for the establishment or performance of a contract 
3. The processing of personal data being mandatory for SIGMA to fulfil its legal obligation 
4. Provided that the personal data have been made public by the data subject, their processing by SIGMA in a manner limited to the purpose for which the data subject made them public 
5. The processing of personal data by SIGMA being mandatory for the establishment, exercise or protection of the rights of SIGMA, the data subjects or third parties 
6. The carrying out of personal data processing activities being mandatory for the legitimate interests of SIGMA, provided that this does not harm the fundamental rights and freedoms of the data subject 
7. The carrying out of personal data processing activities by SIGMA being mandatory for the protection of the life or physical integrity of the data subject or another person, and in this case the data subject being unable to express their consent due to actual impossibility or legal invalidity 
8. With respect to special categories of personal data other than those relating to the health and sexual life of the data subject, being stipulated by law 
9. With respect to special categories of personal data relating to the health and sexual life of the data subject, their processing by persons under an obligation of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, the conduct of treatment and care services, and the planning and management of health services and their financing
10. Management of relations with business partners or suppliers 
11. Conduct of SIGMA’s recruitment and Career Assessment processes 
12. Execution/monitoring of SIGMA’s financial reporting and risk management operations 
13. Execution/monitoring of SIGMA’s legal affairs 
14. Planning and execution of corporate communication activities 
15. Execution of corporate governance activities 
16. Carrying out of corporate and partnership law transactions 
17. Request and complaint management 
18. Provision of information to authorized organizations as required by legislation 
19. Creation and monitoring of visitor records

Where the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the KVKK, the explicit consent of the data subject is obtained by SIGMA for the relevant processing.  

3.3.      RETENTION PERIODS OF PERSONAL DATA 

Where stipulated in the relevant laws and legislation, SIGMA retains personal data for the period specified in such legislation.  

If no period has been regulated in the legislation as to how long personal data must be retained, Personal Data are processed for the period required for their processing in accordance with SIGMA’s practices and the customs of commercial life, depending on the activity carried out by SIGMA while processing such data, and are thereafter erased, destroyed or anonymized.  

Where the purpose of processing personal data has ended and the retention periods set by the relevant legislation and by SIGMA have also expired, personal data may be retained only for the purpose of constituting evidence in possible legal disputes, asserting the relevant right connected to the personal data or establishing a defence. In establishing these periods, retention periods are determined on the basis of the statutory limitation periods for asserting the said right and of examples from requests previously addressed to SIGMA on the same matters despite the expiry of the limitation periods. In this case, the retained personal data are not accessed for any other purpose, and access to the relevant personal data is provided only when they need to be used in the relevant legal dispute. Here too, after the said period expires, the personal data are erased, destroyed or anonymized. During this period, permission to access the relevant Personal Data rests solely with the persons, designated by the Data Controller, who manage user authorizations in the capacity of Data Processor in Information Technologies.  

4. CONDITIONS FOR THE ERASURE, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA  

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVKK, although they have been processed in compliance with the provisions of the relevant law, in the event that the reasons requiring their processing cease to exist, personal data are erased, destroyed or anonymized by SIGMA upon its own decision or upon the request of the data subject.  

4.1.      SIGMA’S OBLIGATION TO ERASE, DESTROY AND ANONYMIZE PERSONAL DATA  

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVKK, although they have been processed in compliance with the provisions of the relevant law, in the event that the reasons requiring their processing cease to exist, personal data are erased, destroyed or anonymized upon the decision of SIGMA or upon the request of the data subject. In this context, in order to fulfil the relevant obligation, our Company has taken the necessary technical and administrative measures within the Company and developed the necessary operating mechanisms in this respect; and in order to act in compliance with these obligations, it trains the relevant business units and ensures their assignment and awareness.  

4.2.      TECHNIQUES FOR THE ERASURE, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA  

Techniques for the Erasure and Destruction of Personal Data  

Although they have been processed in compliance with the provisions of the relevant law, in the event that the reasons requiring their processing cease to exist, SIGMA may erase or destroy personal data upon its own decision or upon the request of the data subject. The erasure or destruction techniques most commonly used by SIGMA are listed below:  

Physical Destruction  

Personal data may also be processed by non-automated means provided that they form part of a data recording system. When such data are erased/destroyed, a system of physically destroying the personal data in such a way that they cannot be used subsequently is applied.  

Secure Erasure from Software  

When data processed by fully or partially automated means and stored in digital environments are erased/destroyed, methods are used to erase the data from the relevant software in such a way that they can never be recovered.  

Secure Erasure by an Expert  

In some cases, SIGMA may engage an expert to erase personal data on its behalf. In this case, the personal data are securely erased/destroyed by the person who is an expert in this field in such a way that they can never be recovered.  

Techniques for Anonymizing Personal Data  

Anonymization of personal data means rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even by matching them with other data. SIGMA may anonymize personal data that have been processed lawfully when the reasons requiring their processing cease to exist. In accordance with Article 28 of the KVKK, anonymized personal data may be processed for purposes such as research, planning and statistics. Such processing falls outside the scope of the KVKK, and the explicit consent of the data subject will not be sought. Since personal data processed after being anonymized will fall outside the scope of the KVKK, the rights regulated in Section 2 of the Policy will not apply to such data. The anonymization techniques most commonly used by SIGMA are listed below.  

1. Masking 

Data masking is a method of anonymizing personal data by removing the basic identifying information of the personal data from the data set. 

1. Aggregation 

With the data aggregation method, many data are aggregated and the personal data are rendered incapable of being associated with any person.

1. Data Derivation 

With the data derivation method, a more general content is created from the content of the personal data, ensuring that the personal data are rendered incapable of being associated with any person. 

1. Data Shuffling 

With the data shuffling method, the values within the personal data set are mixed so that the link between the values and the persons is broken.

SIGMA would like to inform you about your personal data pursuant to “Law No. 6698 on the Protection of Personal Data” (“KVKK”), which was prepared and entered into force for the purpose of protecting fundamental rights and freedoms, in particular the privacy of private life. 

Your personal data are processed within the framework of the methods, legal bases, purposes and conditions specified below for the period stipulated in the relevant legislation or required for the purpose for which they are processed, and all necessary administrative and technical measures for their protection are taken by our company.  

Method of Collecting Personal Data: 

Your personal data may be collected by automated or non-automated means, in written, verbal or electronic form, through the Company headquarters and all affiliated units, the website, social media accounts, integration systems, parties from which our company receives services that complement or extend its activities, contracted institutions, business partners, suppliers and other similar channels. 

Legal Grounds for Collecting Personal Data and Purposes of Processing: 

Customer Data: 

The collected personal data will be processed within the personal data processing conditions and purposes set out in Articles 5 and 6 of Law No. 6698, within the framework of conducting our commercial activities, for the purposes of: carrying out by our business units the work necessary for our customers to benefit from the products and services offered by our Company; customizing and recommending the products and services offered by our Company to customers according to their preferences, usage habits and needs; ensuring the conduct of our Company’s human resources policies; ensuring the legal and commercial security of our Company and of persons in a business relationship with our Company; and determining and implementing our Company’s commercial and business strategies.  You can access detailed information on the purposes for which your personal data are processed by our Company in the Personal Data Protection Policy shared with the public on the website www.sigmamuhendislik.com.tr.  

Since most of our customers are corporate legal entities, the natural persons whose Personal Data we process are generally Data subjects within the scope of Representatives/Personnel of Corporate Customers. The Personal Data relating to these Persons are as follows: 

1. E-mail Addresses, Name-Surname, Telephone and Address Information used for correspondence and campaign notifications
2. Turkish Identity Number, Civil Registry Information, Signature, Telephone and Address Information contained in the Signature Circulars submitted together with contracts
3. Name-Surname, Signature, Telephone and Address Information in the Delivered By field on Waybill Forms
4. Name-Surname, Turkish Identity Number, Telephone and Address Information of the Customer Representatives who will take delivery of the goods belonging to the Customer
5. Name-Surname, Company, Position, Address Information, Telephone and E-Mail Information of persons participating in Dealer/Service trainings 

Our Company may process the following personal data of its natural person customers in order to provide them with better service and to fulfil its contractual and legal obligations. 

1. Name-Surname, Turkish Identity Number, Address Information, Telephone, E-Mail Information 

Visitor Data: 

Camera recordings are made at our company headquarters and other business units for security purposes. For security purposes, the name-surname, vehicle licence plate number, Turkish identity card / passport / driving licence and their numbers, and entry-exit times of visitors coming to our company headquarters and other business units are recorded. 

Data of Parties and Suppliers Obtained within the Scope of Commercial Business Relationships: 

Within the scope of our Company’s commercial business relationships with third parties, such as the procurement of goods and services, leasing, vehicle/joint transportation and agency, personal data of the parties and relevant persons such as name-surname, Turkish identity number, identity document, signature circular, contact details and, depending on the nature of the situation, licence plate number and account number may be obtained for the purposes of the negotiation, establishment, performance and proof of the contract. 

Since the type of business relationship may differ from person to person, not all of the information listed above will apply to every natural person and will vary according to the nature of the work. Your personal data are processed for the purposes of fulfilling our legal obligations arising from legislation; providing Production, Sales, Marketing, Raw Material Import, Product Export and Customs Clearance services, and carrying out, conducting, performing, proving and developing the related transactions; reporting to customers; fulfilling the requirements of the contracts you and/or we have concluded; statistics, customer satisfaction studies, ensuring security, developing commercial and business strategies, analyzing the services provided, and compliance with domestic and international legislation; complying with the information retention, reporting and notification obligations stipulated by the Ministry of Interior, the General Directorate of Security, Local Administrations, the Ministry of Customs, the Directorate of Free Zones, Customs Directorates, the Ministry of Finance, the Revenue Administration, the Ministry of Labour and Social Security, the Social Security Institution and other authorities; carrying out promotional, marketing and campaign activities for these services and products if you have given your permission; and developing services and products suitable for you and maintaining them without interruption. 

Pursuant to the KVKK, general personal data may be processed without seeking your explicit consent where one of the conditions listed in the Law exists: 

1. It is expressly stipulated by law, 
2. It is mandatory for the protection of the life or physical integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent is not legally valid 
3. It is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of the contract.
4. It is mandatory for the data controller to fulfil its legal obligation,
5. The data have been made public by the data subject themselves,
6. Data processing is mandatory for the establishment, exercise or protection of a right, 
7. Data processing is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

 Persons/Organizations to Whom Personal Data May Be Transferred: 

In line with the purposes stated above, your personal data may be transferred, within the legal framework, depending on the type of personal data and limited to the purpose,  to the parties to and persons concerned with cargo/postal shipments; to our company’s domestic and foreign affiliates and their subsidiaries; to its employees, company officials, legal, financial and tax advisors, auditors, firms from which our company receives services that complement or extend its activities, consultants with whom it cooperates, suppliers, sub-carriers, agencies, operators, dealers, service providers, banks and financial institutions; to authorized public institutions and organizations such as the Ministry of Interior, the General Directorate of Security, Local Administrations, the Ministry of Customs, Customs Directorates, the Directorate of Free Zones, the Ministry of Finance, the Revenue Administration, the Ministry of Labour and Social Security, the Social Security Institution and similar authorities, other Ministries, judicial authorities and administrative authorities; and to persons permitted by the provisions of the legislation or institutions and organizations for which you have given your consent. 

Rights of the Data Subject: 

Pursuant to Article 11 of the KVKK, you have the following rights regarding your personal data;

1. To learn whether personal data are processed,
2. To request information if personal data have been processed,
3. To learn the purpose of processing of personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data are transferred domestically or abroad,
5. To request the rectification of personal data if they have been processed incompletely or inaccurately, and to request that the transactions carried out be notified to the third parties to whom the personal data have been transferred,
6. To request the erasure or destruction of personal data within the framework of the conditions stipulated in the KVKK, and to request that the transactions carried out be notified to the third parties to whom the personal data have been transferred,
7. To object to the occurrence of a result to the detriment of the person through the analysis of the processed data exclusively by means of automated systems,
8. To claim compensation for damages in the event of suffering damage due to the unlawful processing of personal data.
9. Until a different method is determined by the Board, applications regarding your rights shall be made in writing directly to the address of our company’s General Directorate. If the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged.
10. You are required to submit your application regarding matters related to the processing of your personal data to our Company by filling in the application form available on the Company’s website sigmamuhendislik.com.tr, either in person, through a notary public, or by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature or your e-mail address previously notified to us and registered in our records. Depending on the nature of your request and your method of application, additional verifications (such as sending a message to your registered telephone number or calling you) may be requested by the Company in order to determine whether the application belongs to you and thereby to protect your rights. For example, if you apply via your e-mail address registered with the Company, we may contact you using another contact method registered with the Company and ask for confirmation of whether the application belongs to you.