PDPL CLARIFICATION TEXT

Data Controller and Representative
Pursuant to Law No. 6698 on the Protection of Personal Data (“PDP Law”) your personal data may be processed by Atasoy Kardeşler Uluslararası Kara ve Deniz Nakliyatı A.Ş (“Company”) as the data controller within the scope described below.

Address: Gayrettepe Mah. Ayazmadere Cad. Atasoy Apt. No: 7/B 34349 Beşiktaş - İstanbul / TÜRKİYE
Phone: +90 212 288 17 86 (Pbx)
Fax: +90 212 211 68 49
E-mail: operation@atasoydenizcilik.com.tr
Web: www.atasoydenizcilik.com.tr

Our purpose is to inform you in the most transparent way about the ways your personal data are collected, the purposes of processing, the persons shared, the legal reasons and your rights in accordance with article 10 of the Personal Data Protection Law No. 6698. As a company established in Türkiye, as the data controller, your personal data we obtain in the following ways;

• Within the scope of our commercial relations or our business relationship with you,
• Within the framework of the purpose requiring their processing and in connection with this purpose, in a limited and measured manner,
• We hereby inform you that the personal data you have notified to us or as notified to us will be recorded, stored, preserved, reorganized, shared with the institutions authorized by law to request this personal data and transferred to domestic or foreign third parties under the conditions stipulated by the PDPL, transferred, transferred, classified and processed in other ways listed in the PDPL.

Purpose for which Personal Data will be Processed
Your personal data collected may be processed by the company for similar purposes and reasons, such as but not limited to the following purposes and legal reasons;
Fulfillment of the purpose required for the performance of the employment contract, especially;
• Approval of employees' leave, displaying outstanding leaves, making leave arrangements,
• Execution of employee dismissal procedures,
• Ensuring that payroll transactions are made,
• Making salary payments to employees,

In order to fulfill the requirements under the Labor Law, Occupational Health and Safety Law, Social Security Law and related legislation and other laws and legislation, in particular;
• Creation of personnel file,
• SGK notifications, İŞKUR notifications, police station notifications and incentive and legal obligation notifications,
• Ensuring the opening of mandatory individual pension insurance accounts,
• Making payments for the salary garnishment deductions of employees' salaries to enforcement files,
• Making legal notifications of work accidents,
• Occupational health and safety procedures,
• To comply with other information retention, reporting and disclosure obligations stipulated by legislation, relevant regulatory bodies and other authorities,
• Fulfillment of court orders.

For the purposes of the administration of the company, the conduct of business, the implementation of company policies, in particular;
• Payment of expenses to employees,
• Ensuring communication with employees,
• Confirmation that the employee to whom the vehicle is allocated or used is competent to drive and has not lost his/her driver's license for any reason,
• Providing the employee with a vehicle and arranging for parking,
• Ensuring business card printing,
• Ensuring that packages arriving via cargo and courier are forwarded to the relevant employee,
• Monitoring the use of company vehicles for the safety of employees and the conduct of business,
• Providing service and travel organization,
• Conducting research projects related to employees,
• Controlling the entry and exit of employees to and from work,
• Recording the documents collected during the job application and interview of employees,
• Ensuring communication for celebratory purposes,
• Training planning, reporting of trainings, preparation of training certificates, tracking of employees who participated in the trainings, tracking the development processes of employees as a result of the trainings they received,
• Ensuring quality control,
• Communication with relevant persons in emergency situations,
• Analyzing satisfaction surveys.

Your personal data may be processed without seeking your explicit consent if it is clearly stipulated by law, if it is directly related to the establishment or performance of a contract, if it is necessary to process personal data belonging to the parties to the contract, if it is mandatory for our Company as the data controller to fulfill its legal obligation, if it is made public by the data subject, if data processing is mandatory for the establishment, exercise or protection of a right, and if data processing is mandatory for the legitimate interests of our Company as the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Within the scope of the Personal Data Protection Law:
• Execution of employee satisfaction and loyalty processes,
• Execution of information security processes,
• Execution of fringe benefits and benefits processes for employees,
• Conducting audit/ethics activities,
• Conducting financial and accounting affairs,
• Ensuring physical space security,
• Execution of assignment processes,
• Follow-up and execution of legal affairs,
• Conducting internal audit/investigation/intelligence activities,
• Conducting communication activities,
• Planning of human resources processes,
• Execution of risk management processes,
• Execution of the remuneration policy,
• Carrying out storage and archive activities,
• Execution of contract processes,
• Follow-up of requests and complaints,
• Ensuring the security of data controller operations,
• Conducting talent/career development activities,
• Providing information to authorized persons, institutions and organizations,
• Carrying out management activities, updating and verifying the accuracy of the information communicated

For the purposes of “data processing is mandatory for the data controller to fulfill its legal obligation” and “provided that it does not harm the fundamental rights and freedoms of the data subject" specified in Articles 5 and 6 of the KVK Law, based on the legal reason that data processing is mandatory for the legitimate interests of the data controller.

Places Where the Processed Data is Transferred and Purpose of Transfer
Your personal data, within the scope of the Laws and other legislation and for the purposes described;
• Companies and representatives operating on behalf and account of our company,
• Regulatory and supervisory authorities, public institutions or organizations that are expressly authorized to request your personal data in their laws,
• Business partnerships, supplier and contractor companies, banks, credit risk and financial institutions and other real or legal persons within the scope of the stated purposes,
• Processed data may be transferred to tax and similar consultants, mandatory persons, institutions and organizations related to legal follow-up processes, and third parties from whom we receive consultancy, including auditors, and without limitation, business partners, third parties from whom services are received, authorized persons and organizations for the above-mentioned purposes, domestically and abroad.

Collection Method of Personal Data and Legal Reason
Your personal data is collected by our company through different channels and for different legal reasons in order to carry out our commercial activities. In order to fulfill our legal obligations as an employer, for the performance of the employment contract between us, for the reasons stipulated in the law and for the legitimate interest of the company, we collect your personal data that we have requested from you personally, that we have requested in advance through our platform or other employment platforms during your job application, or in your resume that you prefer to share with us during your job application or in other texts you share regarding your application, by you transmitting it to us physically or electronically or by recording information open to access by third parties on the internet.

Your personal data collected for this legal reason can be processed and transferred within the scope of the personal data processing conditions and purposes specified in articles 5 and 6 of the PDP Law. Personal data in question is processed within the scope of article 5 of the Law:

• Explicitly stipulated in the law,
• Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract,
• It is mandatory for the data controller to fulfill its legal obligation,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Provided that it does not harm the fundamental rights and freedoms of the data subject, it is processed under the conditions that data processing is mandatory for the legitimate interests of the data controller.

Rights of the Personal Data Owner listed in Article 11 of the PDP Law
As personal data owners, if you submit your requests regarding your rights to our company by the methods set out below in this disclosure text, our company will finalize the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the tariff determined by our company will be charged. In this context, personal data owners;
• To know whether personal data is processed or not,
• Request information if their personal data has been processed,
• To know the purpose of processing personal data and whether they are used for their intended purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,,
• Request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
• To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,
• In case of damage due to unlawful processing of personal data, it has the right to demand compensation for the damage.

Pursuant to paragraph 1 of Article 13 of the PDP Law, you can submit your request to exercise your rights mentioned above to our company in writing or by other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not determined any method at this stage, you must submit your application to our company in writing in accordance with the PDP Law. In this context, the channels and procedures to submit your written application to our company within the scope of Article 11 of the PDP Law are explained below.

Send a signed copy of your request to Gayrettepe Mah. Ayazmadere Cad. Atasoy Apt. No: 7/B 34349 Beşiktaş - İstanbul / TÜRKİYE in person with documents identifying your identity, or you can send it via notary public or other methods specified in the PDP Law.

Exceptions to the Right of Application
Pursuant to article 28/2 of the law, it will not be possible for the data subjects to benefit from the rights set out in article 11 of the law, except for the right to demand compensation for the damage in the following cases

Processing of personal data is necessary for the prevention of crime or criminal investigation,
Processing of personal data made public by the data subject himself/herself

Retention Period of Personal Data
In accordance with the provisions of the PDPL, your personal data, which have been processed for the purposes specified in this “Clarification Text on the Processing of Personal Data” will be deleted, destroyed or anonymized and will continue to be used by us, taking into account the Personal Data Retention and Destruction Policy, when the purpose that requires processing according to Article 7 / f.1. of the PDPL disappears and / or when the statute of limitations that we are required to process your data in accordance with the legislation expires.