KVKK Disclosure Text
Within the framework of the Law No. 6698 on the Protection of Personal Data
OEC ELEKTRONİK HABERLEŞME SİSTEMLERİ LTD. ŞTİ.
DISCLOSURE TEXT ON THE PROCESSING OF PERSONAL DATA
1- Purpose and Scope of Clarification Text
This Text, OEC ELEKTRONİK HABERLEŞME SİSTEMLERİ LTD. ŞTİ. In accordance with the importance that the "Company") attaches to personal data; to reveal the approach of our Company on the protection and processing of personal data of our customers, potential customers, employees, employee candidates, company shareholders, company officials, visitors, employees, shareholders and officials of the institutions we cooperate with and third parties (in short, "data subject") within the scope of the Personal Data Protection Law ("KVKK") and to inform the data subject accordingly has been prepared.
The data included in the Clarification Text ("Text") on the Processing of Personal Data relates to all personal data of the data subject that are processed by automatic means or by non-automatic means provided that they are part of any data recording system.
If this Notice or any of its provisions is revised, its effective date and version will be updated. The Notice is published on the Company’s website (oec.com.tr) and is made available to data subjects upon request.
2- Principles Regarding Personal Data
2-1 Processing of Personal Data
In accordance with the law and honesty rules,
Accurately and, when necessary, up to date,
Pursuing specific, clear and legitimate objectives,
Purpose-related,
In a limited and measured manner,
By keeping it for the period stipulated in the laws or required by the purpose of processing the personal data,
Article 5 of KVKK It is processed on the basis of one or more of the conditions specified in the article.
Our company is in accordance with Article 20 of the Constitution and Article 10 of KVKK. During the acquisition of such personal data in accordance with the clause;
The purpose for which personal data will be processed,
To whom and for what purpose the processed personal data may be transferred,
Method and legal reason for collecting personal data,
Rights of the personal data owner
Fulfills its obligation to inform about the subject.
Legal Reasons for Processing Personal Data
Our company has signed the 5th Article of KVKK. Personal data are processed within the purposes specified in the article and included below.;
Where the Company’s relevant personal data processing activity is expressly provided for by law;
Where processing by the Company is directly related to, and necessary for, the establishment or performance of a contract;
Where processing is mandatory for the Company to fulfil a legal obligation;
Where the personal data has been made public, provided that the Company processes it only for the purpose for which it was made public;
Where processing by the Company is mandatory for the establishment, exercise or protection of the rights of the Company, the data subject or a third party;
Where processing is mandatory for the Company’s legitimate interests, provided that the data subject’s fundamental rights and freedoms are not harmed;
Where processing is mandatory to protect the life or physical integrity of the data subject or another person, and the data subject cannot express consent because of actual impossibility or because that consent is not legally valid.
Article 6 of the Law identifies certain personal data as special categories because unlawful processing may expose individuals to harm or discrimination. These categories include race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. The Company processes special categories of personal data in the following circumstances, subject to the adequate measures determined by the Personal Data Protection Board:
Special categories of personal data other than data relating to health and sexual life are processed where provided for by law.
Personal data relating to health and sexual life is processed by persons subject to a duty of confidentiality or by authorised institutions and organisations for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, or the planning and management of healthcare services and their financing.
Where the processing conditions specified above are not present, the data subject’s explicit consent is obtained.
Transfer of Personal Data
Within the purposes specified in section 2.b of this Notice, the Company may transfer the personal data described in that section for the purposes set out below:
To legally authorised public institutions and organisations, limited to the purposes requested within their legal authority;
To legally authorised private-law persons, limited to the purposes requested within their legal authority.
Purpose of Collecting Personal Data
Your personal data is collected to provide and improve our products and services and to conduct our business activities in accordance with the purposes stated above. During these processes, personal data is collected through our employees and representatives, or through public databases under the relevant legislation, on the legal basis of conducting our business activities. Data collected on this basis may also be processed and transferred for the purposes in sections (b) and (c) of this Notice within the conditions and purposes specified in Articles 5 and 6 of Law No. 6698.
The Company processes personal data for the following purposes in order to provide its services and comply with local legislation, within the conditions described above.
To implement the Company’s human resources policies: conducting HR operations in accordance with those policies, recruiting personnel for open positions in accordance with those policies, fulfilling occupational health and safety obligations and taking the necessary measures.
To fulfil legal and commercial obligations of the Company and persons with whom it has a business relationship: administrative communications operations, service operations, physical security and inspection of Company locations, assessment of business partners, customers and suppliers and their representatives, employees or partners, legal and commercial risk analysis, legal compliance processes and financial operations.
To undertake the work required to recommend products and services tailored to customers’ preferences, usage habits and needs: the Company’s individual and/or integrated marketing activities, sales and after-sales operations.
To determine and implement the Company’s commercial and business strategies: financial operations, communications, market research and social responsibility activities, procurement operations including requests, quotations, assessment, orders, budgeting and contracts, and the determination and implementation of commercial and business strategies.
These purposes also include internal systems and application management and the management of legal operations.
The personal data processed under this Notice is set out in KSV1_LIST. Categories of data subjects are classified in KSV2_LIST.
Retention and Deletion of Data
The Company retains personal data for the periods prescribed by legislation. Where no specific period is prescribed, data is retained for the period required for processing in connection with the services provided, the Company’s practices and commercial customs. After that period, data is retained only for the period established as necessary in practice to serve as evidence in possible legal disputes. At the end of the relevant periods, the personal data is deleted, destroyed or anonymised.
Rights of the Data Subject
Article 20 of the Constitution provides that everyone has the right to be informed about personal data relating to them. Article 11 of the Law also includes the right to request information among the rights of data subjects. The Company provides the necessary information when a data subject exercises this right. This Notice explains how the right may be exercised and how information requests are assessed.
Data subjects have the following rights:
To learn whether their personal data is being processed;
To request information if their personal data has been processed;
To learn the purpose of processing and whether the data is used in accordance with that purpose;
To know the third parties to whom personal data has been transferred in Türkiye or abroad;
To request correction of incomplete or inaccurate personal data and notification of that correction to third parties to whom the data has been transferred;
To request deletion or destruction of personal data when the reasons requiring its processing no longer exist, even if it was processed in accordance with the Law and other applicable legislation, and notification of that action to third parties to whom the data has been transferred;
To claim compensation for damage resulting from unlawful processing of personal data.
Under Article 28 of the Law, the following circumstances fall outside its scope. Data subjects therefore cannot exercise the rights listed above in relation to these matters:
Processing personal data for research, planning and statistical purposes after anonymisation for official statistics;
Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that this does not violate national defence, national security, public security, public order, economic security, privacy or personality rights and does not constitute a criminal offence;
Processing personal data within preventive, protective and intelligence activities conducted by public institutions and organisations authorised by law to ensure national defence, national security, public security, public order or economic security;
Processing personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or execution proceedings.
Under Article 28(2) of the Law, in the following circumstances data subjects cannot exercise the rights listed above, except for the right to seek compensation for damage:
Where personal data processing is necessary to prevent an offence or for a criminal investigation;
Where the personal data has been made public by the data subject;
Where processing is necessary for inspection or regulatory duties or disciplinary investigation or prosecution conducted, under authority granted by law, by authorised public institutions, public organisations or professional organisations with public institution status;
Where processing is necessary to protect the State’s economic and financial interests in relation to budgeting, taxation and financial matters.
Data subjects may submit requests concerning the rights listed above by completing the application form, signing it in ink and delivering it to the Company in person, through a notary or by registered mail with return receipt to Atatürk Mah. Sedef Cad. No:29 Ata 4-5A Blok D:6 Ataşehir, İstanbul. If a person other than the data subject makes the request, a specific power of attorney issued by the data subject for the applicant must be provided.
Duly submitted requests are concluded within thirty days at the latest. If concluding a request requires an additional cost, the Company will charge the applicant the fee specified in the tariff determined by the Board.
The Company may request information to establish whether the applicant is the data subject and may ask questions about the application to clarify its subject matter.
The Company may reject an application, stating its reasons, in the following circumstances:
Processing personal data for research, planning and statistical purposes after anonymisation for official statistics;
Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that this does not violate national defence, national security, public security, public order, economic security, privacy or personality rights and does not constitute a criminal offence;
Processing personal data within preventive, protective and intelligence activities conducted by public institutions and organisations authorised by law to ensure national defence, national security, public security, public order or economic security;
Processing personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or execution proceedings;
Where personal data processing is necessary to prevent an offence or for a criminal investigation;
Where the personal data has been made public by the data subject;
Where processing is necessary for inspection or regulatory duties or disciplinary investigation or prosecution conducted, under authority granted by law, by authorised public institutions, public organisations or professional organisations with public institution status;
Where processing is necessary to protect the State’s economic and financial interests in relation to budgeting, taxation and financial matters;
Where the data subject’s request may obstruct the rights and freedoms of other persons;
Where a request would require disproportionate effort;
Where the requested information is publicly available.
Under Article 14 of the Law, if an application is rejected, the response is considered insufficient or no response is provided in time, the data subject may complain to the Board within thirty days of learning of the Company’s response and, in all cases, within sixty days of the application date.
Security of Personal Data
Security Measures
In accordance with Article 12 of the Law, the Company takes the measures and controls necessary to ensure an appropriate level of security, prevent unlawful processing and unlawful access, and safeguard personal data. It conducts, or arranges, the necessary inspections for these purposes. Measures and controls taken by the Company include the following:
Employing personnel who are knowledgeable and experienced in personal data processing, the relevant legislation and the operation of compliant systems;
Providing personnel with information about personal data protection and including provisions on compliance with data protection legislation and Company procedures in personnel contracts;
Using legally compliant backup programmes that enable personal data to be stored securely;
Where a service involving personal data processing is outsourced, including provisions in agreements with the service provider requiring the necessary security measures and compliance within that provider’s organisation;
Assessing the personal data processing activities conducted by the Company against the processing conditions in the Law and taking the technical and organisational measures necessary for compliant processing;
Establishing and implementing procedures for managing personal data processing and compliance, including measures and controls;
Maintaining and inspecting processing activities through management systems with technical and organisational capabilities appropriate to those activities and systems.
Inspection
In accordance with Article 12 of the Law, the Company conducts or arranges the necessary inspections within its organisation. Results are reported to the relevant department through internal procedures, and the necessary work is carried out to improve the measures taken.
Systems are established and training is provided to ensure that existing and newly recruited employees understand personal data protection.
Management of Data Breaches
In accordance with Article 12 of the Law, the Company operates a system to notify the relevant data subject and the Board as soon as possible if processed personal data is obtained by others through unlawful means. Where the Board considers it necessary, the matter may be announced on the Board’s website or by another method.
Company Name: OEC ELEKTRONİK HABERLEŞME SİSTEMLERİ LTD. ŞTİ.
Telephone: +90 216 325 8872
Fax: +90 216 325 8872
Postal Address: Atatürk Mah. Sedef Cad. No:29 Ata 4-5A Blok D:6 Ataşehir, İstanbul
Email Address: info@oec.com.tr
KSV1_LIST — Categories of Personal Data
Identity Information: All information contained in documents such as driving licences, identity cards, residence certificates, passports, lawyer identity cards and marriage certificates.
Contact Information: Information such as telephone numbers, addresses and email addresses.
Customer Information: Information obtained or generated about a customer’s representative or employee through our commercial activities and the operations of our business units.
Customer Transaction Information: Records concerning the use of our products and services and information such as instructions and requests necessary for customers to use them.
Physical Premises Security Information: Personal data relating to records and documents, including camera recordings made when entering or remaining within physical premises.
Transaction Security Information: Personal data processed to fulfil technical, administrative, legal and commercial obligations while conducting our business activities.
Financial Information: Personal data of a customer’s representative or employee relating to information, documents and records that may produce financial consequences for the customer.
Job Applicant Information: Personal data relating to individuals who have applied to work for the Company, who have been assessed as candidates under commercial customs and good faith in line with the Company’s HR needs, or who have a working relationship with the Company.
Legal Transaction and Compliance Information: Personal data processed to establish and pursue legal claims and rights, fulfil obligations and comply with legislation and Company policies.
Marketing Information: Personal data of a customer’s employee or representative processed to tailor and market products and services according to usage habits, preferences and needs, and the reports and assessments produced through that processing.
KSV2_LIST — Categories of Data Subjects
Customer Employees and Representatives: Employees and representatives of customers who use or have used the Company’s products and services.
Prospective Customer Employees and Representatives: Employees and representatives of legal entities that have requested or expressed interest in our products and services, or may be considered interested in accordance with commercial customs and good faith.
Suppliers and Manufacturers: Natural persons supplying products or services to the Company, or manufacturing using products of the Company or other companies.
Visitors: Natural persons who have entered physical premises belonging to the Company for various purposes or visited our websites.
Third Parties: Natural persons associated with the persons above in order to ensure the security of commercial transactions, protect their rights or obtain benefits, such as guarantors, accompanying persons, family members and relatives.
Job Applicants: Natural persons who have applied for employment or made their CVs and related information available for the Company’s assessment.
Company Shareholders: Natural persons who hold shares in the Company.
Company Officers: Members of the Company’s board of directors and other authorised natural persons.
Employees, Shareholders and Officers of Organisations We Work With: Natural persons, including employees, shareholders and officers of organisations with which the Company has a business relationship, such as business partners and suppliers.