Loading
Schmid Pekintaş Güneş Enerji Sistemleri Sanayi ve Ticaret A.Ş. (“Schmid Pekintaş” or the “Company”) attaches importance to the protection of personal data and conducts its personal data processing activities in accordance with the relevant legislation, particularly Law No. 6698 on the Protection of Personal Data (“KVKK”).
This Personal Data Protection and Processing Policy (the “Policy”) has been prepared to explain the fundamental principles and rules relating to the personal data processing activities carried out by the Company and to establish the general framework for the lawful processing, transfer, retention and, where necessary, deletion, destruction or anonymisation of personal data.
When processing personal data, the Company acts in accordance with the principles set out in Article 4 of the KVKK:
The Company also takes the necessary technical and administrative measures to enable data subjects to effectively exercise their rights under the KVKK, to ensure the security of personal data and to prevent unlawful processing of or unlawful access to personal data.
This Policy is general in nature and does not replace activity-specific privacy notices that must be provided to data subjects at the time personal data are obtained pursuant to Article 10 of the KVKK.
Within the scope of Law No. 6698 on the Protection of Personal Data:
Schmid Pekintaş Güneş Enerji Sistemleri Sanayi ve Ticaret A.Ş.
has the status of data controller in respect of personal data processing activities for which it determines the purposes and means of processing and is responsible for establishing and managing the data recording system.
Personal data processing activities carried out by the Company’s head office, factory, regional directorate and other organisational units on behalf of the Company’s legal entity fall within the scope of this Policy.
For activities in which other group companies within the group of companies or commercial organisation determine their own purposes and means of processing, the status of each company as data controller is assessed separately. Being a group company does not, by itself, mean joint controllership or that personal data may be freely transferred.
The contact information relating to activities conducted by the Company as data controller is as follows:
Address: Büyükdere Caddesi No:32, Pekintaş İş Merkezi, Mecidiyeköy/Şişli/İstanbul
KEP: [Current KEP address will be added.]
Schmid Pekintaş may process personal data, depending on the nature of the activities carried out and the relevant group of data subjects, and in all cases in accordance with the general principles set out in Article 4 of the KVKK, for the following purposes:
For personal data processing activities for marketing, advertising and promotion purposes, explicit consent of the data subject is obtained where there is no other personal data processing condition under the KVKK applicable to the specific activity.
Where commercial electronic communications are to be sent by e-mail, SMS, telephone or similar methods, Law No. 6563 on the Regulation of Electronic Commerce and the relevant legislation are also taken into account in addition to the KVKK.
Personal data processed by Schmid Pekintaş may be transferred to third parties where the transfer is necessary for the relevant personal data processing activity, is based on a specified and legitimate purpose and one of the conditions set out in Article 8 of the KVKK is met.
In this context, depending on the nature of the processing activity and to the extent necessary, personal data may be transferred to:
For each data transfer, the purpose of the transfer, the categories of data transferred, the recipient group and the legal ground for the transfer are assessed separately.
Transfers of personal data to third parties are carried out in accordance with the principles of data minimisation and purpose limitation. The fact that a natural or legal person is a group company, supplier, service provider or business partner of the Company does not, by itself, constitute a legal ground for transferring personal data.
Where personal data processed by Schmid Pekintaş are transferred abroad, the Company acts in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.
The transfer of personal data abroad is primarily carried out subject to the existence of one of the personal data processing conditions set out in Article 5 of the KVKK and, in relation to special categories of personal data, Article 6.
Personal data may be transferred abroad in accordance with the conditions prescribed by law where the Personal Data Protection Board has issued an adequacy decision regarding the country, a sector within that country or an international organisation to which the transfer will be made.
Where no adequacy decision exists, personal data may be transferred abroad by providing one of the appropriate safeguards prescribed by law, provided that the data subject also has the opportunity to exercise their rights and access effective legal remedies in the country of transfer.
In this context, where the relevant conditions are met, the transfer may be based on:
Where a standard contract is relied upon, the notification obligations prescribed by legislation are fulfilled.
Where there is no adequacy decision and no appropriate safeguard can be provided, personal data may be transferred abroad only on an occasional basis and only where one of the conditions exhaustively set out in Article 9 of the KVKK exists.
For occasional transfers based on explicit consent, the data subject is informed of the possible risks of the transfer.
Whether the cloud services, electronic mail infrastructures, software, analytics tools, server services and similar technological services used by the Company result in a transfer of personal data abroad is separately assessed on a specific service-provider and data-flow basis.
Depending on the nature of the Company’s activities, personal data may be obtained through:
Personal data may be obtained by fully or partially automated means or by non-automated means provided that such processing forms part of a data recording system.
Depending on the nature of the specific activity, personal data are processed on the basis of the relevant condition set out in Article 5 of the KVKK:
Special categories of personal data are processed only where one of the conditions set out in the current Article 6 of the KVKK is met and the necessary technical and administrative measures are taken.
Where a personal data processing activity can be based on another legal ground, explicit consent is not used as a general or fallback legal ground.
Each privacy notice addressed to a relevant group of data subjects separately and clearly specifies the purposes for which personal data are processed and the legal ground on which they are collected.
Data subjects whose personal data are processed may apply to the Company under Article 11 of the KVKK and have the right to:
Requests under Article 11 of the KVKK are intended to be submitted to the Company using one of the following methods in order to reliably determine that the application is made by the data subject and to prevent personal data from being disclosed to unauthorised persons:
Written application:
Applications may be submitted in person or by post in a manner that enables identification of the applicant to:
Schmid Pekintaş Güneş Enerji Sistemleri Sanayi ve Ticaret A.Ş.
Büyükdere Caddesi No:32, Pekintaş İş Merkezi, Mecidiyeköy/Şişli/İstanbul
and may be delivered to this address.
Registered Electronic Mail (KEP):
Applications may be sent via the KEP system to:
[Current KEP address will be added.]
and may be sent to this address.
Secure electronic signature or mobile signature:
Data subjects may also submit applications using a secure electronic signature or mobile signature.
Applications made in accordance with the other procedures prescribed in the Communiqué on the Procedures and Principles of Application to the Data Controller are also evaluated within the framework of the relevant legislation.
General e-mail addresses published by the Company on the website or through other communication channels have not been designated as a special application channel for requests under Article 11 of the KVKK.
The Company takes necessary and proportionate measures to verify the identity of the applicant and, where necessary, the authority of a representative, in order to ensure that applications under the KVKK are made only by the data subject or their legally authorised representative and that personal data are not disclosed to unauthorised third parties in the response.
Where the application method, the nature of the request, the scope of the personal data requested or the information submitted during the application gives rise to reasonable doubt about the applicant’s identity, the Company may request additional information or documents for identity verification before concluding the application.
Only information and documents that are necessary and proportionate for verification purposes are requested. Data subjects are not asked to provide personal data or documents that are unrelated to or disproportionate to the nature of the application.
Where an application is made through an attorney or another legal representative, the representative’s authority must be duly documented.
An application must contain the following information:
Where necessary for the proper evaluation of the request, information and documents relating to the subject of the application may also be requested.
The Company concludes applications submitted in accordance with the applicable procedure as soon as possible depending on the nature of the request and in any event no later than thirty days from the date on which the application reaches the Company.
Applications are in principle concluded free of charge. However, where the process entails an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
Where an application is accepted, the Company fulfils the request and informs the data subject of the action taken. Where an application is rejected, the reason for rejection is communicated to the data subject.
Where the response to an application contains personal data, the Company applies appropriate security and identity verification measures to ensure that the response is delivered only to the applicant or their authorised representative.
Depending on the nature of the request or the response, the Company may:
Where there is a risk that personal data may be disclosed to unauthorised persons, the Company does not provide a substantive response containing personal data until identity verification has been completed.
Schmid Pekintaş may record images through security cameras at factories, workplaces, facilities, warehouses, entry and exit points and other areas where security is necessary, for the purposes of ensuring physical premises security, protecting the safety of employees and visitors, protecting assets, preventing unauthorised entry and, where necessary, ensuring occupational health and safety.
In the installation and operation of camera systems, the principle of being relevant, limited and proportionate to the purpose under Article 4 of the KVKK is observed.
In this context:
Audio recording through security cameras is not applied as a rule. Because audio recording constitutes a more serious interference with private life than image recording, it may be separately considered only where there is an explicit and lawful processing condition requiring audio recording in the specific case, the purpose cannot be achieved by a less intrusive method and the proportionality requirement is met.
Persons present in areas monitored by cameras are informed in accordance with Article 10 of the KVKK by means of layered notices or other appropriate methods.
Camera recordings may be shared, on a limited basis, with authorised public institutions and organisations, judicial authorities and legal advisers where there is a legal obligation, a need to establish, exercise or protect a right or another valid processing and transfer condition.
Personal data processed by Schmid Pekintaş are retained for the period specifically prescribed by the relevant legislation, if any, and where no specific period is prescribed, for the period necessary for the purpose requiring the processing of personal data.
When all reasons requiring the processing of personal data cease to exist, personal data are deleted, destroyed or anonymised by the Company ex officio or upon request of the data subject in accordance with Article 7 of the KVKK and the relevant secondary legislation.
Deletion of personal data means making personal data inaccessible and unusable in any way for the relevant users.
Destruction of personal data means making personal data inaccessible, irretrievable and unusable by anyone in any way.
Anonymisation of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching them with other data.
The Company takes the necessary technical and administrative measures in relation to the deletion, destruction and anonymisation of personal data.
Where the Company is under an obligation to prepare a personal data retention and destruction policy pursuant to the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, retention and destruction activities are also carried out in accordance with that policy and the specified periodic destruction periods.
Where a data subject requests deletion or destruction, the request is evaluated within the framework of Articles 7, 11 and 13 of the KVKK and the relevant secondary legislation. If all processing conditions have ceased to exist, the request is fulfilled; if a valid legal ground requiring the retention of personal data continues, the request is concluded by explaining the reason.
