DEMİR GROUP CONSTRUCTION INDUSTRY AND TRADE JOINT STOCK COMPANY
INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA OF EMPLOYEES
This Information Notice sets out the principles regarding the processing of your personal data by Demir Group Construction Industry and Trade Joint Stock Company (“Company”), acting as the data controller, located at “Büyükdere Cad. No.74 D Torun Center Office Kule K:11 N:45 Şişli/Istanbul”, in accordance with the Personal Data Protection Law No. 6698 (“Law”) and relevant legislation.
Detailed information regarding the processing of your personal data by the Company is also included in the Employee Personal Data Protection and Processing Policy. In this context, in the event that documents or information obtained contain personal data belonging to third parties other than you, it is deemed that you have informed the relevant data subjects in accordance with Article 10 of the Law and have obtained the necessary legal basis for sharing such data within the meaning of Article 5 of the Law. In this regard, the obligation to fulfill the disclosure and explicit consent requirements rests with you.
1. Purpose of Processing Personal Data
Your personal data collected and stored in your personnel file and within business processes are used in the scope of the employer’s obligations during the continuation of the employment relationship.
In this context, the following personal data may be processed: identity information, contact information, personnel file data, legal transaction information, financial information, professional experience information, education information, clothing size information (if uniforms are provided), passport information required for visa procedures in case of international business travel, vehicle location data if a company vehicle is assigned, health data required for occupational health and safety and job performance (as sensitive personal data), emails sent and received via company email accounts, criminal record certificate information collected during onboarding, and, where provided for emergency contact and insurance purposes, identity and contact information of your relatives.
The data processing activities carried out within the scope of the employer’s obligations are performed for the following purposes:
- Fulfilling obligations arising from employment contracts and applicable legislation for employees,
- Managing fringe benefits and employee entitlements processes,
- Planning and monitoring employee performance evaluation processes,
- Conducting employee training activities,
- Maintaining personnel files,
- Ensuring occupational health and safety within the Company,
- Planning and/or execution of business continuity processes,
- Planning and execution of corporate governance activities,
- Planning, auditing, and execution of information security processes,
- Managing human resources policies,
- Ensuring internal social interaction within the Company,
- Increasing employee satisfaction and engagement,
- Providing information to authorized persons, institutions, and organizations,
- Conducting legal affairs,
- Executing remuneration policies,
- Monitoring communication tools and content provided by the Company,
- Ensuring security of data controller operations,
- Ensuring physical security of premises,
- Conducting finance and accounting operations,
- Monitoring business email correspondence within the scope of managerial authority.
2. Recipients of Personal Data and Purpose of Transfer
Your personal data may be transferred in compliance with the Law to our business partners, suppliers, tax consultants, shareholders, group companies, affiliates, subcontractors, relevant public authorities, abroad due to the use of cloud systems, third parties in Türkiye and/or abroad with whom the Company has contractual relationships, purchasers of goods and/or services, and legally authorized public institutions (e.g., Social Security Institution). The purpose of processing and transfer is aligned.
The Company cooperates with intermediary institutions for supporting processes such as work operations, working hours, and preparation or storage of personnel file documents. Your personal data may be shared with such institutions in compliance with the Law for the purpose of fulfilling their duties. These institutions are not authorized to use such data for any other purpose.
3. Method and Legal Basis for Collection of Personal Data
Your personal data are collected through various methods, particularly through internal company networks, fully or partially automated or non-automated means, as part of a data recording system, in written and electronic form. Your personal data may be processed and transferred in accordance with the principles, conditions, and exceptions set forth in the Law for the purposes specified in this Notice.
Your personal data may be processed based on the following legal grounds:
- Your explicit consent pursuant to Article 5/1 of the Law for processing activities specified in the consent text,
- Explicit provision in laws pursuant to Article 5/2(a) of the Law (Labor Law No. 4857 Article 75),
- Necessity for the establishment or performance of an employment contract pursuant to Article 5/2(c) of the Law,
- Necessity for compliance with occupational health and safety obligations pursuant to Article 5/2(ç) of the Law,
- Necessity for establishment, exercise, or protection of a legal right pursuant to Article 5/2(e) of the Law,
- Necessity for the legitimate interests of the Company, provided that it does not harm your fundamental rights and freedoms pursuant to Article 5/2(f) of the Law,
- Necessity for compliance with legal obligations in employment, occupational health and safety, social security, social services, and social assistance under Article 6 of the Law.
4. Retention Period of Personal Data
The Company retains your personal data for the period required for the purposes for which they are processed and in accordance with the retention periods stipulated by applicable legislation.
Accordingly:
- Personnel file data: 10 years after termination of the employment relationship,
- Occupational health and safety records: 15 years as a general rule or as required by applicable legislation,
- Payroll, salary, leave, attendance, and fringe benefit records: 10 years after termination of the employment relationship,
- Photos and video recordings from corporate events: until withdrawal of consent, and in any case 3 years from the date of recording,
- Photos and videos used for social media and corporate communication: for the duration of publication and until consent is withdrawn,
- Visa, passport, and travel-related personal data: 10 years after completion of the travel activity,
- Commercial electronic communication consent records: 3 years after withdrawal or termination of consent in accordance with applicable legislation.
Upon expiration of the retention period or when the purpose of processing ceases to exist, your personal data shall be deleted, destroyed, or anonymized in accordance with Article 7 of the Law and relevant legislation.
5. Your Rights and Application to the Data Controller
In accordance with Article 11 of the Law, you have the right to apply to our Company and:
a) learn whether your personal data are processed,
b) request information if processed,
c) learn the purpose of processing and whether it is used accordingly,
d) learn the third parties to whom data are transferred domestically,
e) request correction if incomplete or inaccurate,
f) request deletion/destruction in accordance with Article 7 of the Law,
g) request notification of actions taken under (e) and (f) to third parties,
h) object to results arising exclusively from automated processing,
i) request compensation for damages arising from unlawful processing of your personal data.
You may submit your applications by completing the Data Controller Application Form and sending it via mail to the Company address above or via email to kvkk@demirgrup.com.
The Company will respond to your requests as soon as possible and within thirty (30) days at the latest. Requests are generally free of charge; however, a fee may be charged if additional costs arise. The Company may accept or reject the request with justification.
If your application is rejected, the response is insufficient, or no response is provided within the legal period, you may file a complaint with the Personal Data Protection Board (“Board”) within thirty days following notification, and in any case within sixty days from the date of application. However, complaint procedures cannot be initiated without exhausting the application process.
The Board examines complaints or ex officio investigations within its jurisdiction. If no response is given within sixty days, the request is deemed rejected. If a violation is detected, the Board orders corrective action, which must be implemented within thirty days. In cases of irreparable harm or clear illegality, the Board may suspend data processing or data transfer abroad.
Your data is protected with due diligence by our Company, and we thank you for your trust.
Please indicate your consent by checking the boxes below after reading each statement.
□ I have read and understood the Personal Data Protection Information Notice.
□ Consent for Social Interaction and Corporate Announcements
I hereby give my explicit consent to the processing of my personal data for the purpose of receiving notifications regarding corporate events, celebrations, organizations, and social activities conducted by the Company.
□ Consent for Photo and Video Use
I hereby give my explicit consent for the use of my photos and video recordings taken during Company events within corporate communication activities, including the Company website, corporate social media accounts, publications, and promotional materials.
□ Consent for Visa, Passport and Travel Arrangements
I hereby give my explicit consent for the processing of my passport, identity, and travel information for the planning of domestic or international business travel, visa applications, accommodation, and transportation arrangements, and for sharing such data with relevant authorities and service providers where necessary.
□ Consent for Commercial Electronic Communications
I hereby consent to receiving commercial electronic communications via SMS, email, phone calls, and other electronic communication tools regarding products, services, campaigns, and other informational content provided by the Company.
I declare and undertake that I have given my explicit consent regarding the processing, use, sharing, and retention of my personal data in accordance with the selections above, that I have been duly informed, and that I accept and approve the processing of my personal data based on informed consent.
Name Surname:
Date:
Signature: