YEPSAN Group - LAW ON THE PROTECTION OF PERSONAL DATA NO. 6698 (LPPD)

LAW ON THE PROTECTION OF PERSONAL DATA NO. 6698 (LPPD)

INFORMATION AND DISCLOSURE STATEMENT

Our Company attaches the utmost importance to the processing and protection of your personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“LPPD”). As the data controller, all necessary technical and administrative measures have been taken to prevent the unlawful processing and unauthorized access of personal data and to ensure its secure storage.

Pursuant to Article 10 of the Law, we hereby inform you through this disclosure statement and the policies created for customers, suppliers, service providers, business partners, company shareholders, employees, employee candidates, interns, visitors, public institutions and organizations, private legal entities, and other relevant third parties. Disclosure statements prepared for each relevant group have been separately communicated to the relevant individuals.

This disclosure statement has been prepared by Yepsan Yedek Parça Sanayi Ticaret A.Ş. (“Company”), in its capacity as data controller, in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“Law”) and the Communiqué on the Principles and Procedures to be Followed in the Fulfillment of the Obligation to Inform.

1. DATA CONTROLLER:

Yepsan Yedek Parça Sanayi Ticaret A.Ş. (Kayapa Mah. 13(530) Sokak No: 7A Nilüfer Bursa Türkiye, Tax Office: Ertuğrulgazi – 9490038980, Trade Registry No: 30515, MERSIS No: 9003898000011) processes your personal data in its capacity as “Data Controller” as defined in Article 3 of the Law on the Protection of Personal Data No. 6698.

2. PURPOSES OF PROCESSING PERSONAL DATA:

Your personal data is processed by our Company within the scope of its activities in compliance with Articles 4, 5, and 6 of the Law and related legislation for the following purposes:

To develop the Company’s products and services and carry out corporate development activities,
To carry out the Company’s finance and accounting operations,
To manage the Company’s commercial activities with third parties and procurement processes,
To fulfill legal obligations within the scope of Company activities,
To plan and execute human resources processes and manage job application and internship application procedures,
To create personnel records and fulfill financial obligations,
To conclude and execute contracts and protocols made or to be made with customers, suppliers, employees, and third parties with whom the Company has a legal relationship,
To carry out advertising and marketing activities,
To ensure corporate communication with relevant parties within the scope of Company activities,
To ensure corporate quality and the safety of relevant individuals associated with the Company,
To make mandatory legal notifications to relevant public institutions and organizations, and to provide necessary information to regulatory and supervisory bodies and private legal entities,
To provide evidence in case of legal disputes with third parties,
To ensure corporate and personal development due to participation in Company-organized training, seminars, or events,
To enable the use of our website and to manage processes related to filling out forms on our website,
Through the closed-circuit camera recording system, to monitor safety, ensure legal, technical, and commercial security, prevent criminal activities by third parties, and ensure the physical security of Company buildings, annexes, and surroundings for customers, suppliers, service providers, business partners, employees, employee candidates, interns, visitors, and other relevant third parties.

3. PROCESSED PERSONAL DATA:

The following categories of personal data are processed, limited to the scope of Company activities and for the purposes stated above:

Identity Information (e.g., National ID number, temporary ID number, foreign ID number, name and surname, place and date of birth, parent’s names, marital status, gender, passport, driver’s license, vehicle registration details, population registry information, and other identity details in national ID systems)
Contact Information (phone numbers, address, email, registered email address (KEP))
Location Information (address, location details)
Personnel Records (employment contract, education details, diplomas, certificates, social security entry/exit notifications, dependents’ information, disciplinary records, performance evaluations, payroll, resignation/termination details, health and safety records, etc.)
Legal Transaction Data (personal data in correspondence with judicial authorities, litigation and enforcement case details)
Customer, Supplier, Service Provider Transaction Data (name, ID number, address, email, phone, bank account details, payment details, invoices, contracts, power of attorney, signature circulars)
Physical Security Data (visitor entry-exit logs, security register data, CCTV footage)
Financial Data (balance sheets, performance data, credit/risk details, assets, bank account details, IBAN, customs-related data, domestic and international trade forms, etc.)
Professional Experience Data (education, diplomas, employment history, references, certifications, licenses, training records, etc.)
Visual Data (photos on forms, ID cards, taken during recruitment or Company activities, photos used on websites, campaigns, or social media, and CCTV footage)
Health Data (medical records, test results, disability status, health board reports, occupational health data, etc.)
Criminal Conviction and Security Measures Data (criminal records, judicial data, conviction status)
Data submitted via websites, social media, or call center services, complaints, and related evaluation records
Biometric Data (fingerprint scans for access to server rooms, etc.)
Information obtained through Company call centers, email, postal mail, or other communication channels

4. TRANSFER OF PROCESSED PERSONAL DATA AND PURPOSES OF TRANSFER:

Your personal data processed by our Company is transferred to the following individuals and organizations, in accordance with Articles 8 and 9 of the LPPD, for the purposes specified below:

To our group companies for carrying out Company operations, fulfilling mutual obligations, ensuring cooperation, and coordination,
To public authorities, including Customs Directorate, Revenue Administration, Tax Offices, and Social Security Institution (SGK), for fulfilling legal obligations,
To prosecutors’ offices, courts, enforcement offices, and other authorized entities for public security or legal disputes, upon request and within the limits of legal requirements,
To health service providers and insurance companies for occupational health and safety purposes,
To banks, financial institutions, public or private entities for financial transactions,
To domestic or international software, hardware, and IT service providers for system installation, maintenance, and data security,
To regulatory authorities, ministries, judiciary, auditors, customs offices, consultants, and domestic or international entities in connection with foreign trade and payment service legislation, within the scope of relevant regulations.

5. METHOD OF COLLECTING PERSONAL DATA AND LEGAL GROUNDS:

Your personal data is collected and processed by our Company, within the scope of its legal relations and activities, in verbal, written, or electronic form, through application forms, personnel files, contracts, financial and payroll records, procurement and planning activities, marketing, website visits, call center interactions, fingerprint recognition systems, CCTV surveillance, and other methods, either fully or partially automated, or as part of non-automated data recording systems.

Personal data and sensitive personal data are processed based on explicit consent, as a general principle. However, in the following cases, your personal data may be processed without your explicit consent:

If it is necessary for the conclusion or execution of contracts between the Company and third parties,
If processing is necessary to fulfill legal obligations,
If the data has been made public by the data subject,
If processing is necessary for the establishment, exercise, or protection of a right,
If processing is necessary for the Company’s legitimate interests, provided that fundamental rights and freedoms are not harmed,
If explicitly required by law.

In accordance with Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698 and Article 5/1-h of the Communiqué on the Principles and Procedures to be Followed in the Fulfillment of the Obligation to Inform, your data is collected, processed, and transferred for the purposes stated herein.

6. RIGHTS OF THE DATA SUBJECT (RIGHT TO APPLY):

Pursuant to Article 11 of the Law on the Protection of Personal Data No. 6698, you may submit your requests to Yepsan Yedek Parça Sanayi Ticaret A.Ş., as the data controller, by completing the APPLICATION FORM available on our website and delivering a signed copy with identification documents in person to the Company address at Kayapa Organized Industrial Zone, 13th Street, No:7, Nilüfer, Bursa, Türkiye. Alternatively, you may send it via secure electronic signature, mobile signature, your registered email (KEP) address to our Company’s KEP address yepsanyedekparca@hs01.kep.tr, or by email from your registered address to yepsan@yepsan.com.tr, or by notary, or by any other methods determined by the Personal Data Protection Authority.