BOĞAZİÇİ İTHALAT DIŞ TİCARET PAZ. LTD. ŞTİ.
EMPLOYEE INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA
The Data Controller; BOĞAZİÇİ İTHALAT DIŞ TİCARET PAZ. LTD. ŞTİ. (hereinafter referred to as the “Company” or “Boğaziçi İthalat”) has prepared and published this Information Notice in order to inform employees about the procedures and principles to be followed in the protection of their personal data within the scope of the Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the “KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (hereinafter referred to as the “Communiqué”).
KVKK Article 10: “During the acquisition of personal data, the data controller or the person authorized by it is obliged to inform the data subjects about; the identity of the data controller and its representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of personal data collection, and other rights listed in Article 11.”
We hereby declare that your personal data listed below will be processed at all times;
• In compliance with the law and principles of honesty,
• By ensuring that the personal data you share is accurate and kept up to date as notified to us,
• For specific, explicit and legitimate purposes,
• In a manner that is relevant, limited and proportionate to the purposes for which they are processed,
• By retaining them for the period required by relevant legislation or for the purpose for which they are processed,
in accordance with the conditions stipulated by KVKK and general principles.
Definitions Under the Law
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use, either fully or partially by automatic means or non-automatic means provided that it is part of a data recording system.
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Explicit Consent: Consent that is informed, specific to a particular subject, and given freely.
Board: Refers to the Personal Data Protection Board.
Personal Data of Employees
Personal data of employees may be processed by our Company in accordance with the purposes and processing conditions specified in this text. The personal data subject to processing are as follows:
Identity Data: Name, surname, parents’ names, date of birth, Turkish ID number, gender, marital status, ID card serial number, nationality information, passport information, job title and position, vehicle plate, and family member information.
Contact Data: Phone number, email address, address information, internal company communication information (company phone number, extension number, corporate email address, registered email address).
Financial Data: Bank IBAN number, payrolls, file and debt information related to enforcement proceedings.
Physical Security Data: Entry-exit records, camera recordings, etc.
Legal Transaction Data: Information in correspondence with judicial authorities, information in case files, etc.
Professional Experience Data: Education status, vocational training information, certificates and diplomas, language skills, courses attended, education and competencies, work experience, transcript information.
Visual and Audio Data: Photographs, videos, images, voice and camera recordings of the individual.
Transaction Security Data: IP address information, website login and logout records.
Personnel Data: Payroll information, disciplinary investigation records, employment entry-exit records, CV information, employee satisfaction and performance evaluation reports, insurance information, criminal record, leave dates, military service status, department and unit.
Location Data: Location information.
Health Data: Health reports, blood type, personal health information, maternity/medical leave documents, disability information, information on medical devices and prostheses.
Criminal Conviction Data: Information regarding criminal convictions and security measures.
Other Data: Signature.
Purpose of Processing Personal Data
In accordance with Article 10 of KVKK and Article 5 of the Communiqué, and in compliance with the processing conditions specified in Article 4 of KVKK, personal data of employees may be processed for the following purposes:
- Fulfillment of obligations arising from the service contract, execution of employer responsibilities, ensuring occupational safety, management, supervision, and execution of work,
- Receiving and evaluating suggestions for improving business processes,
- Providing information regarding changes in service conditions,
- Preparation of all records and documents that will form the basis for processing in electronic or physical environments,
- Execution of contractual processes in accordance with Labor Law and other legislation,
- Providing information to public authorities when required by law,
- Fulfillment of legal obligations and exercise of rights arising from legislation,
- Responding to judicial and administrative investigations when required by authorities,
- Execution of emergency management processes,
- Execution of information security processes,
- Fulfillment of obligations arising from employment contracts and legislation,
- Execution of recruitment, internship and placement processes,
- Conducting employee training activities,
- Execution of employee satisfaction processes,
- Execution of performance evaluation processes,
- Execution of training activities,
- Execution of business activities,
- Organization and event management,
- Execution of occupational health and safety activities,
- Execution of assignment processes,
- Execution of communication activities,
- Execution of accounting and finance processes,
- Execution of archiving and storage activities,
- Ensuring the security of movable goods and resources,
- Execution of wage policy,
- Ensuring the security of data controller operations,
- Ensuring physical security of premises,
- Execution of management activities,
- Providing information to authorized public institutions and organizations.
Method and Legal Basis for Collecting Personal Data
Personal data may be obtained directly from the data subject, third parties, and legal authorities during the establishment of a legal relationship. In this context, personal data may be collected through electronic mail, application forms, and verbal, written, or electronic communication channels. We also collect data through cameras installed in the workplace for security purposes, in line with our legal obligations and legitimate interests.
According to Article 5 of KVKK, personal data cannot be processed without explicit consent. However, exceptions include cases where it is explicitly provided by law, necessary for the performance of a contract, required to fulfill legal obligations, made public by the data subject, necessary for the establishment or protection of a right, or necessary for the legitimate interests of the data controller without harming fundamental rights and freedoms.
Transfer of Personal Data
Personal data may be transferred to suppliers, shareholders, authorized dealers, service providers, independent auditors, financial institutions, domestic and international business partners, IT service providers, and legally authorized public institutions in accordance with Articles 8 and 9 of KVKK, provided that adequate security measures are taken.
Retention Period of Personal Data
Personal data will be retained in accordance with KVKK until the purpose requiring processing ceases and/or legal retention periods expire, after which they will be deleted, destroyed, or anonymized.
Rights of the Data Subject
The data subject has the right to learn whether their data is processed, request information, learn purposes, know third parties, request correction or deletion, object to automated processing, and claim compensation for damages.
Exceptions to the Right of Application
In cases listed under Article 28/2 of KVKK, except for compensation claims, the rights under Article 11 may not be exercised.
Application Method
Applications can be made in accordance with Article 13 of KVKK. Requests will be responded within 30 days. Fees may apply if additional costs arise.
DATA CONTROLLER CONTACT INFORMATION
BOĞAZİÇİ İTHALAT DIŞ TİCARET PAZ. LTD. ŞTİ.
Mersis No: 0179049770600011
Web Address: https://www.bogaziciithalat.com.tr/
E-mail: info@bogaziciithalat.com.tr
Kep Address: bogazicipazarlama@hs01.kep.tr
Address: Gayrettepe, Yıldız Posta Street, D Plaza No:52 D:47, 34000 Beşiktaş/Istanbul
