Purpose
The protection of personal data is one of the fundamental corporate policy issues of Alon Metal San. ve Tic. Ltd. Şti. (DORLIVA). In all commercial and social activities carried outby DORLIVA, maximum care and effort have been shown regarding the confidentiality of personaldata collected from real persons due to the nature of the work, and such data has not been shared withunauthorized or unrelated third parties outside the framework or purpose mandated by the legislation.
Even before the enactment of the Law on the Protection of Personal Data No. 6698 (“KVKK” or theLaw) in 2016, which initiated a new era regarding personal data security in our country, our Companyacted with utmost sensitivity regarding the privacy and security of individuals‘ personal data. Movingforward, as DORLIVA, we pledge to comply with the principles, fundamentals, and proceduresstipulated by the Law, along with universal basic principles related to this field.
Scope and Amendments
First and foremost, we have endeavored to prepare this Policy document, which we present to theattention of the public and our addressees, in accordance with the basic principles and fundamentalsstipulated in Law No. 6698.
Our Privacy Policy aims to ensure the security and protection of data obtained through automatedmeans belonging primarily to our employees, as well as our customers, potential customers, goods andservice suppliers, visitors, employee candidates, customers and employees of our business partners, and other individual addressees, and it encompasses corporate regulations regarding these matters.
Personal data obtained from data subjects with their explicit consent/approval or in accordance withother legal grounds specified in the aforementioned Law will be evaluated and utilized in line with ourlegal obligations and legitimate commercial interests. These primarily include improving our productand service quality, executing human resources management, performing administrative and technicalactivities and conducting financial transactions, optimally meeting our customers‘ requests andsuggestions regarding our products and services, developing our sectoral business plans and strategies, and improving our quality management and policies.
Apart from this, certain data required for the purpose of creating a statistical database is anonymizedin a way that permanently prevents the identification of the data subject. Therefore, such data does not fall within the scope of Law No. 6698 and, consequently, this Policy.
As DORLIVA, we would like to declare that we reserve the right to amend our Policy Document andall our corporate internal regulations regarding personal data security, such as directives, instructions, etc. prepared based on this policy, provided that such amendments comply with the Law and aim toimplement more effective measures for data security.
CORE PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
Data Minimization Principle
According to this principle, known as the data minimization principle, data received by DORLIVA is processed into the system only to the extent necessary. Therefore, the specific data we collect is determined based on the purpose. Unnecessary data is not collected. Redundant information is not recorded in the system; it is either deleted or anonymized. This data may be utilized for statisticalpurposes.
Deletion, Destruction, and Anonymization of Personal Data
Upon the expiration of legally mandated retention periods, the completion of judicial processes, orwhen other requirements cease to exist, such data is deleted, destroyed, or anonymized by ourCompany either ex officio (automatically) or upon the request of the data subject. Operations regarding this matter are carried out in accordance with our corporate Personal Data Retention andDestruction Policy.
Accuracy and Data Currency
As a rule, data within DORLIVA is generally processed as declared by the data subjects. DORLIVA is under no obligation to investigate the accuracy of the data declared by customers or individualscontacting DORLIVA, nor is this carried out due to legal reasons and our operating principles. Declared data is accepted as accurate. The principle of accuracy and currency of personal data has alsobeen adopted by DORLIVA. Our Company updates the personal data it has processed based on officialdocuments received or upon the request of the relevant data subject. It takes all necessary measures forthis purpose.
Confidentiality and Data Security
Personal data is confidential, and DORLIVA complies with this confidentiality. Personal data can onlybe accessed within DORLIVA by authorized persons based on specific data categories. All necessarytechnical and administrative measures within available means are taken to protect the personal datacollected by DORLIVA, to prevent it from falling into the hands of unauthorized persons, and toensure the data subject does not suffer any grievance. Within this framework, it is ensured thatsoftware complies with international standards, third parties are selected with due care, and thePrivacy Policy is strictly adhered to within DORLIVA. Third parties with whom we share personaldata in accordance with the law are also required to protect the data.
Purposes of Data Processing
All operations defined as the processing of personal data under the Law shall be performed in line withthe purposes specified in the Clarification Texts prepared regarding the processing of personal data.
Data of Customers, Potential Customers, and Business Partners
Collection and Processing of Data for Contractual Relationships
If a contractual relationship has been established with customers and potential customers, the collectedpersonal data may be used due to legal obligations without obtaining the explicit consent of thecustomer (Article 5 of the KVKK). This use takes place strictly in line with the purpose of thecontract. Data is used to the extent of better execution of the contract and the requirements of theservice, and is updated by contacting the customers or upon their request.
Data of Business Partners
Our Company adopts compliance with the law as a fundamental principle when sharing data with itsbusiness partners. Data is shared with business and solution partners under a data confidentialitycommitment and strictly to the extent required by the service, and these parties are mandatorilyrequired to take necessary measures to ensure data security.
Data Processing for Promotion, Awareness, and Advertising Purposes
DORLIVA utilizes electronic, visual, and audio media such as websites and social media, as well as printed materials, to raise awareness among the public and its addressees, to promote and market itsgoods and services, to introduce its business, or to increase its recognition through content such as campaigns, celebrations, and well-wishes. The explicit presence of the data subject’s consent is mandatory, regardless of the category of the personal data being processed.
Furthermore, when electronic commercial messages or SMS need to be sent to individuals‘ mobile devices for advertising purposes, DORLIVA possesses full knowledge and awareness that therequirement to obtain prior consent must be fulfilled in accordance with the Regulation on Commercial Communication and Commercial Electronic Messages.
Data Processing Activities Carried Out Due to DORLIVA’s Legal Obligations or ExplicitProvision in the Law
Personal data may be processed without obtaining separate approval if the processing is explicitlyspecified in the relevant legislation or for the purpose of fulfilling a legal obligation determined by thelegislation. The type and scope of data processing operations must be necessary for the legallypermitted data processing activity and must comply with the relevant legal provisions.
Data Processing
DORLIVA may process personal data for its legitimate purposes/interests regarding the products andservices it offers or as arising from the legislation. However, data can under no circumstances be usedfor unlawful transactions or activities.
Processing of Special Categories of Personal Data (Sensitive Data)
In the processing of special categories of personal data, DORLIVA takes all the necessaryadministrative measures specifically determined by the Personal Data Protection Board, along with alltechnical measures at a reasonable level that can be expected of it. Within our Company, specialcategories of personal data are processed according to the principles specified in the “Policy on theProtection and Processing of Personal Data”. In processing health data, which falls under the specialcategory, the provisions of the Regulation on Personal Health Data are also taken into consideration.
Data Processed Through Automated Systems
DORLIVA acts in compliance with the Law regarding data processed through automated systems. Information obtained from this data cannot be used against the individual without their explicitconsent. However, DORLIVA may make decisions regarding the individuals it will transact with byutilizing the data within its own system.
User Information and the Internet
DORLIVA has a website used under its own domain name. In cases where personal data is collected, processed, and used on websites, other systems, or applications, the relevant data subjects areinformed via a privacy notice and, if necessary, regarding cookies.
Data Belonging to Our Employees
Transfer of Personal Data Domestically and Abroad
Data may be shared with shareholders and board members in line with the requirements of administrative transactions and activities related to DORLIVA’s senior management, and with solutionpartners due to the administrative and commercial necessities brought by business partnerships.
Additionally, personal data may be transferred to our Company’s suppliers to ensure the fulfillment of goods and services necessary for executing our Company’s commercial activities, which we procurefrom external goods and service suppliers (such as servers, cloud services, etc.).
Consequently, DORLIVA holds the authority to transfer personal data domestically and abroad withinthe scope of the conditions determined by the Board, in compliance with other conditions in the Law, and subject to the consent of the individual.
Rights of the Data Subject
As a Data Subject, you have the rights explicitly enumerated in Article 11 of the Law on theProtection of Personal Data No. 6698 (“KVKK”) to ensure that you maintain control over the fate of your personal data. To facilitate and assist you in exercising these rights, a special Application Form has been created, which you can obtain from our website upon request.
By applying through the methods announced by DORLIVA on our website, you possess the followingrights regarding your personal data:
a) To learn whether your personal data is being processed,
b) To request information if your personal data has been processed,
c) To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
d) To know the third parties to whom personal data is transferred domestically or abroad,
e) To request the correction of personal data if it has been processed incompletely orinaccurately,
f) To request the deletion or destruction of personal data within the framework of theconditions stipulated in Article 7,
g) To request notification of the operations carried out pursuant to subparagraphs (d) and (e) tothird parties to whom the personal data has been transferred,
h) To object to the occurrence of a result against you exclusively through the analysis of processed data via automated systems,
i) To request compensation for damages in case of loss due to the unlawful processing of personal data.
Conversely, individuals do not possess any rights regarding anonymized data within DORLIVA. Inaccordance with business and contractual relationships, DORLIVA may share records containingpersonal data with relevant institutions and organizations for the purpose of executing a judicial dutyor the legal authorities of a state power.
As personal data subjects, you can send your requests regarding your aforementioned rights to ourcorrespondence address by completely filling out the application form available on the official websiteof DORLIVA, attaching your wet signature and a photocopy of your identity document (for theidentity card, only the front side photocopy is sufficient), or you can contact us via our RegisteredElectronic Mail (KEP) address. Depending on the nature of your request, your applications will be answered as soon as possible or within 30 days at the latest after reaching our Company. You mustsubmit your applications either by coming to our Company in person, through a notary public, or bysending an e-mail to our Corporate e-mail address from the e-mail address you have previouslyprovided to us. Furthermore, only the portion of the application that concerns you personally will be responded to; applications made on behalf of your spouse, relatives, or friends will not be accepted. DORLIVA may request additional relevant information and documents from applicants if deemednecessary.
Confidentiality Principle
Data belonging to both employees and other individuals within DORLIVA is confidential. No one mayuse, copy, reproduce, transfer to others, or utilize this data for any purpose other than businessoperations without a contractual ground or legal compliance.
Transaction Security
All necessary technical and administrative measures within available means are taken to protect thepersonal data collected by DORLIVA, prevent it from falling into the hands of unauthorized persons, and ensure that our customers and potential customers do not suffer any grievances. Within thisframework, it is ensured that software complies with required standards, third parties are selected withdue diligence, and the Privacy Policy is strictly adhered to within DORLIVA. Security measures arecontinuously updated and improved.
Audit
In compliance with the mandatory provision in Article 12 of the Law, DORLIVA, in its capacity as data controller, is audited by DORLIVA Executives regarding the protection of personal data, andexternal audits are conducted when necessary.
Notification of Breaches
DORLIVA acts with the awareness that when it is notified of any personal data breach, it must notifythe Personal Data Protection Board without delay and within 72 hours at the latest from the date of learning about the situation. It minimizes and compensates for the damage to the data subject. In theevent that personal data is acquired by unauthorized external parties, it immediately reports thesituation to the Personal Data Protection Board. You can make an application regarding thenotification of breaches according to the procedures specified on our corporate website.
