Oraybir İnşaat

PDPL

PERSONAL DATA PROTECTION CLARIFICATION TEXT

This clarification text has been prepared by Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti. in its capacity as the data controller, in accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data (“Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

Data Controller

Personal data belonging to employees, employee candidates, property owners, interns, supplier employees, supplier representatives, customers, and visitors are processed in accordance with privacy principles and are reported in the VERBIS system. The scope in which the data is processed by Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti., in its capacity as the data controller, is explained in this clarification text (“Clarification Text”).

How Are Personal Data Collected and What Is the Legal Basis?

Personal data, including sensitive personal data such as health information, may be collected wholly or partially through automated or non-automated means, provided they are part of a data recording system. These data may be obtained from the data subject, location-based systems, or from the authorized representative of the supplier company. Collected personal data may be processed and transferred within or outside the country, for the purposes specified below, in accordance with the fundamental principles set out in the Law and the legal grounds stated in Articles 5 and 6.

When Can Personal Data Be Processed Without Explicit Consent?

Under Article 5 of the Law, Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti. may process personal data without seeking explicit consent under the following conditions:

  • If expressly permitted by law,

  • If it is necessary to protect the life or physical integrity of the data subject or another person when the data subject cannot express consent due to actual impossibility,

  • If it is directly related to the establishment or performance of a contract,

  • If processing is required to fulfill a legal obligation,

  • If the data subject has made the data public,

  • If it is necessary for the establishment, exercise, or protection of a right,

  • If processing is necessary for the legitimate interests of the data controller, provided this does not harm the data subject’s fundamental rights and freedoms.

In accordance with Article 6, sensitive personal data may be processed without explicit consent if:

  • The processing of sensitive data other than health and sexual life is permitted by law,

  • Sensitive data related to health and sexual life may only be processed by authorized persons or institutions under the obligation of confidentiality, for purposes such as public health protection, preventive medicine, diagnosis, treatment, and the management of health services and financing.

Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

  • Execution of candidate and internship application processes

  • Fulfillment of employment and statutory obligations for employees

  • Management of employee benefits and related processes

  • Implementation of training activities

  • Management of access authorizations

  • Ensuring compliance with legislation

  • Conducting financial and accounting operations

  • Ensuring physical space security

  • Management of assignment procedures

  • Follow-up and management of legal affairs

  • Execution of communication activities

  • Planning of human resources processes

  • Execution and auditing of business activities

  • Management of occupational health and safety processes

  • Execution of service procurement processes

  • Management of after-sales support services

  • Execution of sales processes

  • Performance evaluation

  • Execution of contract processes

  • Management of wage policies

  • Informing authorized persons, institutions, or organizations

  • Creation and follow-up of visitor logs

These purposes may be carried out by Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti. and other natural and/or legal persons mentioned in Section V.

To Whom and For What Purpose May Personal Data Be Transferred?

Collected personal data may be transferred to authorized public institutions and organizations, real persons or private law legal entities, companies to be contracted with Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti., and their partners, suppliers, and service providers for purposes such as:

  • Legal process follow-up

  • Permits and assignments for field staff

  • Initiation of subscriptions and notification of bill payments

  • Ensuring physical premises security

  • Providing information to authorized persons/institutions

  • Obtaining telephone lines

  • Granting access to partner software systems

  • Meeting tender application requirements

  • Fulfillment of legal obligations

  • Social security declarations

  • Card printing

  • Opening of corporate user accounts

  • Salary payments

  • Execution of contract processes

  • Recording of intern attendance

  • Creating e-prescriptions after diagnosis

Data may also be transferred to foreign countries declared by the KVKK Board as having adequate protection ("Countries with Adequate Protection"), or if not, to countries where data controllers have committed to adequate protection in writing and with the approval of the KVKK Board ("Countries with Committed Adequate Protection").

What Are the Rights of the Data Subject?

Under Article 11 of the Law, data subjects have the right to:

  • Learn whether their personal data has been processed,

  • Request information regarding processed data,

  • Learn the purpose of processing and whether it is being used in accordance with the purpose,

  • Know third parties to whom the data is transferred domestically or abroad,

  • Request correction of incomplete or incorrect data,

  • Request deletion or destruction of data when processing purposes are no longer valid,

  • Request that correction, deletion, or destruction operations be notified to third parties,

  • Object to outcomes arising solely from automated processing,

  • Request compensation for damages due to unlawful processing.

How Can Data Subjects Exercise Their Rights?

To exercise the above rights, the data subject must complete the application form and submit it through the channels indicated therein to Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti.. The company will respond to the request free of charge within thirty (30) days. However, if the process incurs an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.

How Long Will Personal Data Be Processed?

In accordance with the Law, personal data processed for the purposes stated in this Clarification Text will be deleted, destroyed, or anonymized by Oraybir İnşaat ve Restorasyon San. Tic. Ltd. Şti. when the reasons for processing are no longer valid and/or the legal time limitations requiring data processing expire.