Personal Data Storage and Destruction Policy

GENERAL INFORMATION TEXT ON PERSONAL DATA

• About the Law on the Protection of Personal Data:

This “General Clarification Text” is published by PLUSMAK MAKINA SAN. VE TIC. LTD. STI.  (“PLUSMAK MAKINA”), by the Law on the Protection of Personal Data No. 6698 (“KVKK”), as the Data Controller, within the framework of Article 10 titled “Disclosure Obligation of the Data Controller” and Article 11 titled “Rights of the Data Subject” in the KVKK; It is provided to inform you about the purpose for which your data will be processed, to whom and for what purpose your processed personal data can be transferred, the method and legal reason for the collection of your data and your other rights listed in Article 11 of the KVKK and to obtain your consent in the following matters.

We are committed to protecting the privacy and security of the personal data you provide to us. Accordingly, we take the necessary technical and administrative security measures to protect your data against unauthorized access, damage, loss, or disclosure.

Information about the personal data of our employees is provided by the Clarification Text for Personnel.

• Your Data We Receive and the Purposes of Processing:

PLUSMAK MAKINA processes the personal data that you have shared through its website (www.plusmak.com.tr) and other channels included in this clarification text, again limited to the purposes specified in this clarification text. PLUSMAK MAKINA, its full address is Hacıeyüplü Mah. 3125 Sokak No:16/3 Merkezefendi / Denizli / Turkey and its tax number is GÖKPINAR Tax Office – Tax No: 7300399943. In terms of KVKK, our Company operates as a “Data Controller”.

When you visit the website of PLUSMAK MAKINA and/or share your data with PLUSMAK MAKINA to be used for the processing purposes specified in this clarification text, you are deemed to have been informed about the provisions contained in this clarification text and the privacy policy on our website.

As PLUSMAK MAKINA, as the Data Controller, within the framework of our legal obligations arising from the Law on the Protection of Personal Data No. 6698 (“KVKK”), the Turkish Criminal Code No. 5237, the Law No. 5651 on the Regulation of Publications on the Internet and the Fight Against Crimes Committed Through These Publications and the relevant secondary legislation and all legislation related to our activities without limitation, and in the transactions we carry out to continue the company activities we collect data.

1. Personal Data Collected from Our Customers: Name-surname, e-mail address, address, telephone number, security camera images in case of visiting our company, photographs if taken, etc. data.
2. Personal Data We Collect from Our Suppliers: In the process of purchasing products or services, the name-surname of the supplier official and its employees, contact information (Phone, e-mail), other personal data of the supplier personnel providing the service according to the nature of the service, security camera images in case of visiting our company, etc.
3. Personal Data We Collect from Job Applicants: Identity, communication, professional experience (Education, education and work history), criminal record, identity and contact data of references, nationality, place and date of birth, gender, marital status, military status, health/disability status, etc.  The candidate may have shared other personal data that are not requested by our company in his / her resume, these data are not used or processed by PLUSMAK MAKINA.
4. Other: Name-surname, contact information, etc. obtained from other parties contacted during the execution of business activities.
5. All Visitors: During the Covid-19 outbreak, the risk status accessed by the body temperature measurement data and HES code inquiry of all people entering the workplace

Purposes of Processing: (All are available on a categorical basis in our VERBIS registration)

The purposes for which we process include, but are not limited to:

1. To fulfill our legal obligations regulated in the legislation
2. To understand the needs of our customers and to be able to offer the right offer
3. To improve communication with customers and to provide more effective and quality service
4. To be able to carry out marketing and sales processes
5. To provide information to authorized persons, institutions, and organizations
6. Invoicing and collecting
7. Managing job application processes and evaluating the candidate (For job applicants)
8. Conducting purchasing processes (for suppliers)
9. To be able to carry out our business processes (Other parties)

These personal data are; To benefit from the services we offer as PLUSMAK MAKINA, by your explicit consent or in other cases stipulated in paragraph 2 of Article 5 of the KVKK, especially in the legal legislation to which we are subject, all necessary information security measures will be taken provided that they are not used outside the purposes and scope determined by the Information on the Protection of Personal Data and will be kept during the legal retention period or for the period required by the purpose of processing and the purpose of processing it will be destroyed at the end of the required period or used in anonymization.

• In What Ways We Collect Your Data:

Your data is collected verbally, in writing, or electronically, within the scope of the purposes stated above and to fulfill legal obligations and terms of service.

Personal data provided by you directly to PLUSMAK MAKINA: All information and documents you have submitted, requests for proposals, contracts, orders, job application forms or resumes, etc.

Personal data collected during the execution of business processes: correspondence, e-mail correspondence, telephone, or face-to-face meetings, etc.

Personal data collected at fairs: Information and documents collected during interviews in sectoral fair organizations

Personal data collected during your visits to PLUSMAK MAKINA: From the security entrance, in the areas where there is a security camera sign, the images taken with the security camera, IP No, etc. are recorded through the wifi connection if used. During the Covid-19 outbreak period, all people entering the workplace (Personnel, visitors, customers, suppliers, etc.) are measured by a digital thermometer and body temperature measurement, HES code inquiry.

Personal data we collect through cookies and similar technologies: By  automated means through www.plusmak.com.tr, provided that they comply with legal requirements

Personal data is collected through the contact form at www.plusmak.com.tr: Identity, contact.

• With Whom We Share Your Data:

PLUSMAK MAKINA may share and transfer your data with the relevant parties based on your explicit consent or in other cases stipulated in Article 5/f.2 of the KVKK, especially in the legislation to which we are subject, provided that adequate measures are taken within the framework of the security and confidentiality principles specified in the KVKK. The data that you have shared with us will not be shared with third parties except for the processing and sharing purposes stipulated in KVKK or without your explicit consent.

Your data, which is kept in an electronic environment, is transferred to our company’s Qnap backup unit (domestic).

Job application forms, information submitted by our website, or resumes sent by hand/e-mail of employee candidates are not transferred to other persons and organizations without their explicit consent.

Personal data collected from other parties may be transferred to authorized persons, institutions, or organizations by obtaining the explicit consent of the data owner in cases requiring explicit consent if it is necessary to transfer them for processing, or as required by legal necessity or non-explicit processing condition.

• Rights of the Data Subject (Data Subject)

By KVKK, as the data owner, your data:

• Find out if it’s been processed
• Request information if it has been processed
• Find out the purpose of processing and whether it is used appropriately for the purpose
• Know the third parties to whom it is transferred domestically or abroad
• If it is incomplete, incorrectly processed, or changed, request a correction
• Within the framework of Article 7 of the KVKK, requesting its deletion or destruction
• Requesting notification of transactions from third parties to whom it is transferred
• To object to the occurrence of a negative result due to its analysis exclusively by automated systems, and
• You have the right to request compensation for the damage in case of damage due to processing contrary to KVKK.

The requests you will make in this context must be in writing within the scope of the 6698 Personal Data Protection Law. For this purpose, you can send your application to the plusmak@plusmak.com.tr address of our Company with your e-mail containing your explanations of the right you want to use together with the documents identifying your identity, you can send your application through a notary public or you can submit it to www.plusmak.com.tr through the application form (Request and Evaluation Form for Personal Data) on our website.

If your application for these purposes requires an additional cost, you may be required to pay the amount of the fee in the tariff to be determined by the Personal Data Protection Board. Your requests included in your application will be concluded as soon as possible and within 30 (thirty) days at the latest depending on the nature of the request.

Contact Us: If you have any questions or concerns regarding the General Clarification Text or our other data protection practices, or if you have an access request, you can contact us at Hacıeyüplü Mah. 3125 Sokak No:16/3 Merkezefendi / Denizli / Türkiye or by calling +90 (258) 371 04 05.

• Enforcement and Amendments

This clarification text entered into force as of 10.12.2020. In case of changes in the Law or the Personal Data Inventory, the revision number and date will be changed and the stakeholders will be informed again.

PERSONAL DATA STORAGE AND DESTRUCTION POLICY

POLICY OBJECTIVE:

This policy has been prepared based on the Regulation on the Deletion, Destruction or Anonymization of Personal Data to define our company’s approach to the storage and management of the destruction of the personal data it receives and processes.

TANIMLAR:

Destruction: Deletion, destruction, or anonymization of personal data

Recording media: Any medium containing personal data that are fully or partially automated or that is processed by non-automated means provided that it is part of any data recording system.

Periodic destruction: If all of the conditions for the processing of personal data in the Law are eliminated, the deletion, destruction, or anonymization process specified in the personal data retention and destruction policy and to be carried out ex officio at repeated intervals

Data recording system: It refers to the recording system in which personal data is structured and processed according to certain criteria.

GROUNDS FOR STORAGE AND DESTRUCTION, RETENTION AND DESTRUCTION PERIODS:

To fulfill its legally obligatory activities and commercial activities, our Company securely stores the personal data it processes in physical and/or electronic environments within the retention periods determined by the Personal Data Inventory and announced publicly in the VERBIS (Data Controllers Registry). In the Personal Data Inventory, it is defined in which environments each personal data is processed, stored, and destroyed. Personal data are kept by the requirements of the Personal Data Protection Law No. 6698, Labor Law No. 4857, the Occupational Health and Safety Law No. 6331, and all legislation concerning our company activities.

In determining the retention periods of personal data, the legal reason for the processing of personal data or the purpose of processing is taken into consideration. If the personal data is data collected and processed as required by legal conditions, the retention period is defined in the Personal Data Inventory as the period specified in the relevant legislation. For other data, the periods to ensure that the relevant activities can be carried out for the processing are determined and defined in the Personal Data Inventory. Retention periods are sometimes defined as “months”, “years”, while for some personal data, they are defined as “…. At the end”, “………… until it is done”. For this reason, a different retention period may be valid for each personal data regarding the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Personal data are stored by taking “Data Security Measures” announced publicly at VERBIS. In addition to administrative measures such as preparing authorization matrix for employees, conducting training, and making confidentiality agreements with employees and data processors, technical data security measures such as the use of up-to-date antivirus systems, use of firewalls, backup, encryption, etc. are taken.

In the destruction of personal data, according to the method chosen, deletion, destruction, and anonymization are acting in a way that does not make it possible to access, restore, use, or associate the personal data with the data owner.

The personal data whose retention period has expired are destroyed according to the determined destruction methods and the transaction is recorded using the Data Destruction Report. These records are kept for at least 3 years.

In the storage and destruction of personal data, the responsible determined by the “Personal Data Inventory” and the “Authorization Matrix for Personal Data and the Management of Authorizations Table” take part. Those who take part in the destruction processes are recorded in the Data Destruction Minutes.

Our Company reviews the personal data every 3 months (March, June, September, and December), identifies the data whose retention period has expired and deletes, destroys, or anonymizes the personal data in the first periodic destruction process following the date on which the obligation to delete, destroy or anonymize the personal data arises. This period does not exceed six months.

DESTRUCTION OF PERSONAL DATA AT THE REQUEST OF THE PERSON CONCERNED (DATA SUBJECT)

Personal data owners can request information about their data by using the communication methods in our General Clarification Text on Personal Data. If this request is for the deletion of personal data:

1. If all of the conditions for processing personal data have been eliminated, the personal data subject to the request will be destroyed. The request of the person concerned shall be concluded within 30 days at the latest and shall be informed in writing / electronically.
2. If all of the personal data processing conditions have been eliminated and the data subject to the request have been transferred to the data processing parties, our company shall notify the Data Processor of the situation and ensure that the destruction procedures are carried out.
3. If all of the personal data processing conditions have not been eliminated, they are rejected by our company by explaining the reason, and the rejection response is notified in writing / electronically within 30 days at the latest.

SOCIAL MEDIA USAGE POLICY

PLUSMAK MAKINA SAN. VE TIC. LTD.STI. uses the following social media platforms:

• Facebook
• Instagram

When it is necessary to open a page/account, the authority to open the pages and to manage them belongs to the Information Processing Officer. Apart from this, the accounts and pages opened are not related to our company. In case of detection, PLUSMAK MAKINA SAN. VE TIC. LTD.ŞTİ.may apply for legal remedies. On the pages, photos and videos taken during the company’s activities (factory-wide, production activity, fairs, etc. events, social activities, etc.) are shared. Apart from this, celebrations/commemorations, and messages of national and religious holidays can be published.

On social media pages, the necessary parameters and privacy settings are made by the IT Officer.

The images of our employees in the photos and videos can only be published if their explicit consent is obtained, otherwise, the images of our customers, suppliers, and visitors are not included if their permission is not obtained. In the shares, the names of our employees are not labeled, and no personal data is shared without their permission.

Apart from this, the rules that our employees should pay attention to in the use of social media are explained below:

1. In social networks, PLUSMAK MAKINA SAN. VE TIC. LTD.ŞTİ., or if an opinion is expressed on a matter related to the sector, it must be stated that you have a personal opinion.
2. The company has to protect its colleagues and its reputation. Any discrediting comments will be avoided.
3. No discrediting comments will be made about customers, competitors, suppliers, public or private institutions, and organizations.
4. PLUSMAK MAKINA SAN. VE TIC. LTD.ŞTİ. employees, customers, suppliers, and other stakeholders will not be shared.
5. On social networks, they should not share photos of other people and tag their names without approval.
6. Discriminatory comments, harassing, racist, religious or sexually explicit, offensive, or offensive will not be written.
7. On the company’s social media pages, no commercial product will be advertised, and no propaganda of any political party will be made.
8. The person, office, meeting, details of the working content, venues, etc. within the company will not be tagged in social media. Photos taken within the company will not be shared by tagging the company name.
9. If there is any doubt about content that is intended to be shared, the HR Officer will be consulted.
10. It is necessary to be careful when uploading any content (text, images, videos, etc.) to social media platforms. Trademarks or copyrights may be infringed without realizing it.
11. Employees are personally responsible for the content they share and post on social media.
12. In case of misunderstanding of written messages in social media, the spelling rules will be complied with.
13. Unauthorized persons should never introduce themselves as the official spokesperson of the firm.
14. Negative messages written by others about the company will not be written negatively, a prudent and courteous approach will be taken.
15. It will be made aware that what is shared on the Internet, even if it is removed or deleted, cannot be completely removed.

REQUEST AND EVALUATION FORM FOR PERSONAL DATA