Privacy Notice

 

Regarding the Processing of Personal Data

Data Controller	:	Cengiz Holding A.Ş.
Address	:	Altunizade Mah., Kısıklı Cad., No: 37, 34662, Üsküdar, İstanbul / Türkiye

Cengiz Holding Anonim Şirketi (“Cengiz Holding”) has prepared this Privacy Notice in order to inform you about the processing of your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“Law No. 6698”) and the applicable legislation.

Through this Privacy Notice, you may obtain information regarding our identity as data controller, the purposes for which your personal data are processed, the parties to whom and the purposes for which they may be transferred, the methods and legal grounds for the collection of your personal data, and your rights under Law No. 6698.

 

Purposes of Processing Your Personal Data and Legal Grounds

Your personal data processed in line with our Company's activities, the purposes of such processing and the legal grounds relied upon are grouped and explained below.

 

Employees

Detailed information regarding the personal data processed in relation to our employees is provided through internal channels accessible to Cengiz Holding employees. If you are a former employee of our Company, you may exercise your rights through one of the methods specified in this Privacy Notice.

 

Job Applicants

Detailed information regarding the personal data processed in relation to job applicants is provided during the recruitment and evaluation processes through channels accessible to the applicants. If you are a former job applicant, you may exercise your rights through one of the methods specified in this Privacy Notice.

 

Visitors

 

·         Identity Information

• Personal Data Processed

Name, Surname, Turkish Identification Number, Date of Birth

• Purposes of Processing

Execution of Information Security Processes / Execution of Audit-Ethics Activities / Management of Access Authorisations / Execution of Internal Audit-Investigation-Intelligence Activities / Execution of Communication Activities / Execution and Supervision of Business Activities / Ensuring the Security of Movable Assets and Resources / Providing Information to Authorised Persons, Institutions and Organisations

• Legal Grounds

Your identity information is processed by Cengiz Holding based on Article 5 of Law No. 6698, particularly on the legal ground that processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

 

·         Physical Premises Security Information

• Personal Data Processed

CCTV Recordings

• Purposes of Processing

Ensuring Compliance with Legislation / Ensuring Physical Premises Security / Execution of Storage and Archiving Activities / Creation and Monitoring of Visitor Records

Legal Grounds

Your physical premises security data are processed by Cengiz Holding based on Article 5 of Law No. 6698, particularly on the legal ground that processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

• Methods of Collection

Physical premises security data are collected through closed-circuit camera systems (CCTV).

 

Business Partners – Stakeholders – Third Parties

Personal data processed regarding individuals whose data are collected through official channels within the scope of legal disputes arising from the business activities conducted by Cengiz Holding (e.g., mediators, legal representatives, authorised officials of relevant institutions), as well as individuals contacting Cengiz Holding via the contact form available on our website or through email, are grouped as follows:

 

·         Identity Information

• Personal Data Processed

Name, Surname, Turkish Identification Number

• Purposes of Processing

Execution of Information Security Processes / Execution of Audit-Ethics Activities / Management of Access Authorisations / Execution of Internal Audit-Investigation-Intelligence Activities / Execution of Communication Activities / Execution and Supervision of Business Activities / Ensuring the Security of Movable Assets and Resources / Providing Information to Authorised Persons, Institutions and Organisations

• Legal Grounds

Your identity information is processed pursuant to Article 5 of Law No. 6698 based on:

• Necessity for compliance with a legal obligation of the data controller;
• Necessity for the establishment, exercise or protection of a right;
• Necessity for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

 

• Methods of Collection

Your identity information is collected through printed documents, emails and information/documents declared by you.

 

·         Contact Information

• Personal Data Processed

E-Mail Address, Mobile Phone Number

• Purposes of Processing Personal Data

 

Execution of Information Security Processes, Execution of Audit / Ethics Activities, Execution of Training Activities,  Management of Access Authorisations Ensuring Compliance with Legislation, Execution of Finance and Accounting Processes, Ensuring Physical Premises Security, Execution of Assignment Processes, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Communication Activities, Execution and Supervision of Business Activities, Execution of Occupational Health and Safety Activities, Collection and Evaluation of Suggestions for the Improvement of Business Processes, Ensuring Business Continuity, Execution of Logistics Activities, Execution of Procurement Processes for Goods / Services, Execution of After-Sales Support Services, Execution of Sales Processes for Goods / Services, Execution of Goods / Service Production and Operational Processes, Organisation and Event Management, Execution of Performance Evaluation Processes, Execution of Risk Management Processes, Execution of Storage and Archiving Activities, Execution of Contract Processes Execution of Sponsorship Activities, Execution of Strategic Planning Activities, Follow-up of Requests / Complaints, Ensuring the Security of Movable Assets and Resources, Execution of Supply Chain Management Processes, Execution of Remuneration Policies, Providing Information to Authorised Persons, Institutions and Organisations, Execution of Management Activities

• Legal Grounds

Your contact information is processed pursuant to Article 5 of Law No. 6698 based on:

• Necessity for compliance with a legal obligation of the data controller;
• Necessity for the establishment, exercise or protection of a right;
• Necessity for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

 

• Methods of Collection

Your contact information is collected through printed documents, emails and information/documents declared by you

 

·         Legal Transaction Information

• Personal Data Processed

Information contained in correspondence with judicial or administrative authorities;
Information included in formal notices and warnings;
Litigation and enforcement file information

• Purposes of Processing

Execution of Audit / Ethics Activities, Ensuring Compliance with Legislation, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Storage and Archiving Activities, Execution of Contract Processes, Providing Information to Authorised Persons, Institutions and Organisations, Execution of Management Activities.

Legal Grounds

Your legal transaction information is processed pursuant to Article 5 of Law No. 6698 based on:

• Necessity for compliance with a legal obligation of the data controller;
• Necessity for the establishment, exercise or protection of a right;
• Necessity for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

 

• Methods of Collection

Your legal transaction information is collected through printed documents.

 

·         Other Information

• Personal Data Processed

Message Content, E-mail Content, Ethics Hotline Notification Contents, Request-Suggestion-Complaint Information

• Purposes of Processing

Execution of Audit / Ethics Activities, Ensuring Compliance with Legislation, Follow-up and Execution of Legal Affairs, Providing Information to Authorised Persons, Institutions and Organisations, Execution of Occupational Health and Safety Activities, Execution and Supervision of Business Activities, Follow-up of Requests / Complaints, Execution of Storage and Archiving Activities.

• Legal Grounds

The above-mentioned data are processed pursuant to Article 5 of Law No. 6698, particularly based on the legal ground that processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

• Methods of Collection

Such data are collected through information declared by you and via email.

 

Personal Data Processed Within the Scope of the Ethics Reporting Line

Personal data processed within the scope of notifications submitted through our Ethics Reporting Line may fall within the data categories specified in this Privacy Notice; however, such processing activities are carried out under the Cengiz Holding Compliance Programme and are of a specific and sensitive nature.

For detailed information regarding the purposes of processing and potential recipients of personal data processed within the scope of ethics reporting processes, please refer to the “Privacy Notice on the Processing of Personal Data in Ethics Hotline Notifications”.

 

Transfer of Personal Data and Purposes of Transfer

Your personal data may be transferred in accordance with Law No. 6698 and the applicable legislation, limited to the purposes of processing and in compliance with the principles of data minimisation and proportionality.

Within this scope, your personal data may be transferred:

• To persons explicitly authorised under the legislation, primarily the Social Security Institution, and other competent public institutions and organisations, where required by legal regulations. In addition, your personal data may be shared with authorised persons or public authorities upon a court decision or upon the lawful request of an authorised administrative authority.
• To our suppliers, limited strictly to the products or services procured under a service agreement and only to the extent necessary for the provision of such services, for purposes including but not limited to: execution of employee satisfaction and engagement processes; management of employee benefits and entitlements; execution of audit/ethics activities; finance and accounting processes; follow-up and execution of legal affairs; execution and supervision of business activities; occupational health and safety processes; procurement processes; organisation and event management; contract processes; supply chain management; and work and residence permit procedures for foreign personnel.
• To Cengiz Holding A.Ş.’s Group Companies, limited to what is necessary for the execution of company activities, finance and accounting processes, execution and supervision of business activities and contract processes, and only to the extent required by the nature of the business, in compliance with the principle of data minimisation.
• To natural persons or private legal entities, limited strictly to the purposes of executing communication activities, business activities, sales processes for goods/services, organisation and event management, and contract processes, and only to the extent required by the relevant business relationship.

 

Transfer of Your Personal Data Abroad

Your personal data may be transferred abroad in accordance with Law No. 6698 and the applicable legislation, limited to the purposes of processing.

Within this scope, your personal data may be transferred:

• To relevant group companies, projects or business units for the purpose of conducting the Company’s overseas projects and operations;
• To technical service providers located abroad (such as cloud service providers) for the purpose of ensuring information technology infrastructure, data storage and archiving activities;
• To social media platforms headquartered abroad within the scope of international communication and corporate promotion activities, where you have provided your explicit consent.

Any sharing conducted through social media platforms is carried out based on the explicit consent of the data subject or where the data have been made public by the data subject.

 

Retention of Personal Data

Where a retention period is stipulated by law or applicable legislation, personal data shall be retained for at least the minimum period prescribed therein.

Where no retention period is specified by law, personal data shall be retained for reasonable periods determined in accordance with the purposes of processing and in compliance with the principles of relevance, limitation and proportionality.

 

Your Rights as a "Data Subject"

Pursuant to Article 11 of Law No. 6698, as a Data Subject you have the right to:

• Learn whether your personal data are processed;
• Request information if your personal data have been processed;
• Learn the purpose of processing and whether your personal data are used in accordance with such purpose;
• Learn the third parties to whom your personal data are transferred domestically or abroad;
• Request rectification of incomplete or inaccurate personal data;
• Request the erasure or destruction of personal data within the framework of the conditions set forth under Law No. 6698;
• Request notification of third parties to whom your personal data have been transferred regarding rectification, erasure or destruction carried out upon your request;
• Object to the occurrence of a result against you through the analysis of processed data exclusively by automated systems;
• Request compensation for damages arising from the unlawful processing of your personal data.

 

Exercising Your Rights

You may submit your requests regarding your rights listed under Article 11 of Law No. 6698 to our Company through the Data Subject Application Form in accordance with Article 13 of Law No. 6698 and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, using one of the methods specified below:

Application Method	Application Address	Required Information / Documents
Written Application	Altunizade Kısıklı Cad. No: 37 34662 Üsküdar, İstanbul / TÜRKİYE	In-person submission with valid identification
Written Application	Altunizade Kısıklı Cad. No: 37 34662 Üsküdar, İstanbul / TÜRKİYE	Signed petition (wet signature) together with a copy of identification document or submission via notary
Secure Electronic Signature or Mobile Signature	Altunizade Kısıklı Cad. No: 37 34662 Üsküdar, İstanbul / TÜRKİYE	Submission via secure electronic or mobile signature stating in the subject line: “Information Request under the Personal Data Protection Law”
Application via Registered Electronic Mail (KEP) Address	[email protected]	Submission via KEP stating in the subject line: “Information Request under the Personal Data Protection Law”

 

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, the Data Subject must include the following information in the application: first and last name; signature if the application is submitted in writing; Turkish Identification Number (or, for foreign nationals, nationality together with passport number or identification number, if any); residential or workplace address for notification purposes; if available, email address, telephone and fax number for notification; and information relating to the subject matter of the request.

The Data Subject must clearly and explicitly specify, in the application, the right they seek to exercise under Article 11 of Law No. 6698. Any relevant information and supporting documents concerning the request must also be attached to the Application Form.

The request must relate to the applicant personally. Where the application is submitted on behalf of another person, the applicant must be duly authorised to act on their behalf and such authorisation must be documented. If the application concerns special categories of personal data, the applicant must be specifically authorised in accordance with Article 10 of the Regulation on Personal Health Data. The application must include identity and address details and be accompanied by documents verifying identity.

Requests submitted by unauthorised third parties on behalf of another person shall not be evaluated.

 

Response to Requests

Your requests regarding your personal data shall be responded to as soon as possible and in any event within thirty (30) days from the date on which your application is received by our Company.