Human Resources | CSM Metalurji

CSM METALURJİ İMALAT SANAYİ VE MÜHENDİSLİK LTD. ŞTİ.
INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This Information Notice has been prepared by CSM Metalurji İmalat Sanayi ve Mühendislik Ltd. Şti (“Company”) in order to inform the Company’s customers regarding the processing of their personal data by the Company within the scope of the Personal Data Protection Law No. 6698 (“Law”).

Detailed information regarding the processing of your personal data within the scope of this Information Notice can be found in the CSM Metalurji Personal Data Protection and Processing Policy available at www.csmmetal.com.tr.

a) Methods of Collection of Personal Data and Legal Grounds

Your personal data is collected electronically or physically. Your personal data collected based on the legal grounds specified in this Information Notice may be processed and shared within the framework of the personal data processing conditions set forth in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Your personal data is processed within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law for the purposes of planning and executing the activities necessary for customizing and recommending the products and services offered by the Company according to the preferences, usage habits, and needs of the relevant persons; carrying out the necessary work by the business units to enable the relevant persons to benefit from the products and services offered by the Company and conducting the related business processes; carrying out the necessary work by the relevant business units for the execution of the commercial activities conducted by the Company and carrying out related business processes; planning and execution of the Company’s commercial and/or business strategies; and ensuring the legal, technical, and commercial-business security of the Company and the relevant persons who have a business relationship with the Company.

c) Parties with Whom Personal Data May Be Shared and Purposes of Sharing

Your personal data may be shared, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, with the Company’s business partners and suppliers, legally authorized public institutions and organizations, and legally authorized private legal entities for the purposes of planning and executing the activities necessary for customizing and recommending the products and services offered by the Company according to the preferences, usage habits, and needs of the relevant persons; carrying out the necessary work by the business units to enable the relevant persons to benefit from the products and services offered by the Company and conducting the related business processes; carrying out the necessary work by the relevant business units for the execution of the commercial activities conducted by the Company and carrying out related business processes; planning and execution of the Company’s commercial and/or business strategies; and ensuring the legal, technical, and commercial-business security of the Company and the relevant persons who have a business relationship with the Company.

d) Rights of Data Subjects and Exercise of Such Rights

If personal data owners submit their requests regarding the rights listed below to the Company through the methods specified under the heading “Exercise of Rights by Data Subjects,” their requests shall be evaluated and concluded by our Company as soon as possible and in any case within thirty (30) days.

Pursuant to Article 11 of the Law, as a personal data owner, you have the following rights:

To learn whether your personal data is processed,
To request information if your personal data has been processed,
To learn the purpose of the processing of your personal data and whether such data is used in accordance with its purpose,
To know the third parties to whom your personal data is transferred domestically or abroad,
To request correction of your personal data if it is processed incompletely or inaccurately and to request notification of the transaction made within this scope to third parties to whom the personal data has been transferred,
To request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, despite having been processed in accordance with the Law and other relevant legal provisions, and to request notification of the transaction made within this scope to third parties to whom the personal data has been transferred,
To object to the occurrence of a result against yourself arising from the analysis of processed data exclusively through automated systems,
To request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which data subjects do not have the right to make requests. Accordingly, the above-mentioned rights cannot be exercised in the following cases:

Where personal data processing is necessary for the prevention of a crime or for a criminal investigation,
Where personal data has been made public by the data subject himself/herself,
Where personal data processing is necessary for the execution of supervisory or regulatory duties and disciplinary investigations or prosecutions by authorized public institutions and organizations and professional organizations having the nature of public institutions, based on the authority granted by law,
Where personal data processing is necessary for the protection of the economic and financial interests of the State regarding budgetary, tax, and financial matters.

Pursuant to Paragraph 1 of Article 28 of the Law, in the following cases, data shall fall outside the scope of the Law; therefore, requests of data subjects regarding such data shall not be processed:

Processing of personal data by natural persons within the scope of activities related solely to themselves or family members living in the same household, provided that the data is not disclosed to third parties and obligations regarding data security are complied with,
Processing of personal data for purposes such as research, planning, and statistics by anonymizing such data together with official statistics,
Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that national defense, national security, public security, public order, economic security, privacy, or personal rights are not violated and no crime is committed,
Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law for ensuring national defense, national security, public security, public order, or economic security,
Processing of personal data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial, or execution procedures.

Exercise of Rights by Data Subjects

Data subjects may use the “ Form Regarding Applications to be Made by the Personal Data Subject to the Data Controller ” available at www.csmmetal.com.tr in order to exercise the above-mentioned rights.

Applications shall be submitted together with documents identifying the relevant data subject through one of the following methods:

Delivery of the completed and wet-signed copy of the form by hand, through a notary public, or via registered mail with return receipt to Türkgücü OSB Mah. Yılmaz Alpaslan Cad. No:88/2 Çorlu 59850/Tekirdağ-TÜRKİYE,
Sending the form signed with a secure electronic signature issued within the scope of the Electronic Signature Law No. 5070 to the registered electronic mail address csmmetal@hs03kep.tr,
Following a method prescribed by the Personal Data Protection Board.

The Company responds to data subjects wishing to exercise the aforementioned rights within a maximum of thirty (30) days in accordance with the procedures stipulated by the Law and within the limits prescribed therein. In order for third parties to submit an application request on behalf of personal data owners, a special power of attorney issued through a notary public in the name of the person making the application must be available.

Although applications submitted by data subjects are generally processed free of charge, fees may be charged according to the tariff determined by the Personal Data Protection Board.[1]

The Company may request information from the applicant in order to determine whether the person making the application is the owner of the personal data and may direct questions to the personal data owner regarding the application in order to clarify the matters specified in the application.

[1] Pursuant to the “Communiqué on the Procedures and Principles of Application to the Data Controller” published in the Official Gazette dated 10.03.2018 and numbered 30356, if the response to the application is provided in writing, no fee shall be charged for up to ten pages. For each page exceeding ten pages, a processing fee of 1 Turkish Lira may be charged. If the response to the application is provided on a recording medium such as a CD or flash memory, the fee that may be requested by the Institution shall not exceed the cost of the recording medium.