PERSONAL DATA PROCESS AND PROTECTION POLICY

  1. PURPOSE & SCOPE

From past to present, Lineer Hidrolik Pnömatik Elektrik Elektronik Makine Ltd. Şti (“Lineer Makina”) adopted to show utmost importance to the order of law. Accordingly, all kinds of operations are being carried out in order to conform with Protection of Personal Data Law numbered 6698 and the sub legal regulations which are intended for process and protection of personal data. Lineer Makina Personal Data Process and Protection Policy (“PVP Policy”) aims to determine the basic principles to be applied for carefully processing and protecting personal data in all departments, operations and processes as remaining limited with legitimate purposes in accordance with the law. Sustainability of data safety principle in our company is aimed by adopting PVP Policy. In this policy, basic principles are expressed to conform the operations run by Lineer Makina to the current regulations in the law. PVP Policy is applied for personal data of natural persons such as Lineer Makina employee candidates, old employees, consultants, shareholders, employees of business associates and visitors and which is not processed by Lineer Makina automatically by being a part of a Data Registry request completely or partially. Lineer Makina sets up the necessary system to create awareness about protection of personal data and procures the necessary order to provide internal transactions to conform with regulations of personal data protection and process. PVP policy is published on website of Lineer Makina (http://www.lineermakina.com) and it is open for access of personal data owners. In parallel with the changes and innovations in the related regulation, amendments to be occurred Lineer Makina PVP Policy will be open to access of personal data owners in a way they can access easily. In case there is a contradiction between the law and Lineer Makina PVP Policy, the provisions of the law in force will be deemed binding.

  1. DEFINITIONS

“Express Consent” Written consent which is declared with a free will and related to a certain subject and referring to a briefing. “Disposal” Deletion, disposal of personal data or anonymizing personal data, “Personal Data” All kinds of information on identified person or identifiable natural person (Expression of "Personal Data” in this PVP Policy also comprise “Special Quality Personal Data” in the degree where it is applicable. “Data Owner/Related Person” Natural person whose personal data is being processed. “Process of Personal Data” All kinds of transaction carried out over data such as collection, record, storage, amendment, rearrangement, disclosing, transfer, taking over, being acquirable, classifying or detention of use of personal data non-automatically by being a part of an automatic data registry system completely or partially.

“Lineer Makina Business Partners” As carrying out the commercial operations, persons who sells goods or services to Lineer Makina and without being limited with these, associating partnership with various purposes. “. “Application Form of Data Owner” The application form which can be used by Personal Data Owner while making applications related to rights stated in article 11 of the Law. “Data Processor” Natural or legal person who processes the personal data in the name of Data Supervisor upon the authority given by Data Supervisor, “Data Supervisor” Lineer Hidrolik Pnömatik Elektrik Elektronik Makine Ltd.  who is responsible with the foundation and management of data registration system which determines the purposes and tools of personal data process, “Special Quality Personal Data” Data related to race, origin, political view, philosophical thought, religion, sect or other beliefs, dress, society, foundation or union membership, health, sexual life, conviction and safety precautions, and biometric and genetic data.

  1. ROLES & RESPONSIBILITIES

Lineer Makina; all function and employees, employee candidates, former employees, consultants, shareholders, employees of business associates, visitors and other natural persons are responsible with application, generalizing and sustainability of the determined principles of PVP Policy.

  1. PRINCIPLES ON PROCESS OF PERSONAL DATA

 

Lineer Makina always follow the principles in the following and ensures that employees also follow these principles:

 

  1. Conforming rules of law and righteousness

Lineer Makina personal data always adopt processing data in accordance with rules of law and principles of righteousness as primary purpose.

  1. Providing right and updated data

Lineer Makina tries to provide that collected personal data is right and updated as much as the technical possibility and takes necessary precautions to correct faulty data or to confirm the accuracy of the data when necessary

  1. Processing personal data in accordance with purpose, in a limited and measured way

Lineer Makina processes personal data for clear, public and certain purposes and in a limited and measured way in relation with these purposes. Personal data is not processed with the thought of it will also be required in the future periods. Lineer Makina shows regard to basic rights and benefits of the data owners.

  1. Storing the personal data for the required duration for the process purpose or the duration stated in the related regulation

 

Lineer Makina preserves the personal data for the duration stated in the related regulation or for the required reasonable duration for the process purpose and conforms to time limitations. Lineer Makina disposes the personal data following the expiration of the duration stated in the regulation and the reasons to process of personal data disappear.

 

 

  1. CONDITIONS OF PERSONAL DATA PROCESS

Personal data is processed in accordance with the principles and basis stated in the following.

  1. Express Consent

Personal Data is processed with the express consent of Data Owner following the sufficient briefing given to Data Owner in the frame of fulfilling disclosure requirement. Lineer Makina briefs the Data Owner about the matters stated in the following:

  • The purpose of processing the Personal Data,
  • Who and with what purpose the processed personal data can be transferred to,
  • The method of personal data collection and legal cause,
  • The rights of the related person that arise from PVP Law,
  • Commercial Title of Lineer Makina as the Data Supervisor.

 

  1. Process of Personal Data without requiring Express Consent

In case of one of the following conditions, it is possible to process Personal Data without requiring Express Consent of Data Owner:

  • Predicted clearly in Laws.
  • When it is mandatory to process personal data to preserve the life of the person or someone else or the body integrity of a person who is unable to express his/her consent with the reason of legal disability or a person whose consent is not valid in the law.
  • On condition that it is related directly with exercise or drawn of an agreement, when it is required to process the Personal Data of parties of the agreement.
  • When it is mandatory to process personal data to fulfill the legal obligation of Lineer Makina as Data Supervisor.
  • When the personal data is made public by the related person himself/herself.
  • When it is mandatory to process data to establish, exercise or protect a right.
  • When it is mandatory to process data for the legitimate interests of Lineer Makina as data supervisor on condition that fundamental right and freedoms of the related person is not damaged.

 

  1. Conditions of Special Quality Personal Data Process

Special Quality Personal Data can be processed with the Express Consent of the Data Owner. If the Express Consent of the Data Owner is not available;

  • Special Quality Personal Data of the Data Owner except the data about sexual life and health, can be processed without requiring Express Consent in the event where it is predicted in the laws clearly.
  • And the Special Quality Personal Data related to sexual life and health data of the data owner can be processed without requiring Express Consent with the purpose of preserving public health, carrying out preventive medicine, medical diagnosis, treatment and cure services, planning and management of health services and finance.

As Special Quality Data are being processed, adequate precautions determined by Personal Data Protection Committee are taken.

  1. PROTECTION OF PERSONAL DATA

Necessary precautions are taken in Lineer Makina with the purpose of protecting personal and special quality personal data. Close attention is paid to prevent usage and sharing of data with other reasons and to prevent access of unauthorized people. In this context,

  1. administrative measures
  2. technical measures are taken for protection of personal data, preserving safety and confidentiality and
  3. highest level of conformity is aimed
  4. measures predicted in Personal Data Protection Law are taken to prevent disclosure of personal data with unlawful means.

6.1 Administrative Measures:

  • Employees are trained about protection of personal data and their awareness is provided.
  • In the agreements made with the people which personal data is transferred, regulations are made to provide data safety of transferring party.
  • The conformity of employees to the law and related policy and procedures prepared in this context is supported with discipline procedure.
  • Personal data processing operations which are being carried out by Lineer Makina are examined in detail and in this context, necessary steps to provide conformity with predicted personal data process conditions are determined.

6.2 Technical Measures:

  • Technical measures are taken to the extent permitted by technology in relation to protection of personal data by Lineer Makina, and the measures taken are updated and improved in parallel with developments.
  • Expert personnel in technical matters are employed and external service is provided when necessary.
  • Audits are made in regular intervals for application taken measures.
  • Data safety is supported via installed software and systems.
  • Access authority to personal data being processed in Lineer Makina is limited with related employees in the direction of the purpose of determined operation.

6.3 Audit Operations related to Personal Data Protection:

· It is audited in Lineer Makina whether all kinds of measures or applications with the purpose of providing personal data protection and safety by Lineer Makina are being applied in a sustainable way, whether it is efficient and in conformity with the Law.

· In case Lineer Makina deems it necessary, whole audit process or a part of it can be carried out by an external audit company.

· The regular follow up of actions planned related to audit results is the responsibility of process owners.

· Without being limited to audit results, operations that will improve and better the measures taken about data protection is carried out by related functions.

6.4 Measures to be taken in case Personal Data is Disclosed with Unlawful Means:

In case personal data is acquired by unauthorized people via unlawful means during personal data process operations carried out by Lineer Makina, Lineer Makina notifies this to Data Owner and Personal Data Protection Council when it is necessary.

  1. TRANSFER OF PERSONAL DATA

7.1. Transfer In Country

Lineer Makina can transfer Personal Data to third parties by taking Express Consent of Personal Data Owner and without taking Express Consent in exceptional cases in accordance with the principles in the Law.

In this context, Lineer Makina can transfer personal data to the people groups stated below;

PEOPLE WHOM THE DATA CAN BE TRANSFERRED TO

DESCRIPTION

PURPOSE OF DATA TRANSFER

Business Associate

Parties that Lineer Makina get into partnership with the purpose of carrying out commercial operations.

It is transferred limitedly to fulfill the purposes of foundation of business association, considering necessity and proportion.

Supplier or Customer

Parties that supply goods/service to Lineer Makina or Parties that Lineer Makina supply goods/service in accordance with the order and directions of Lineer Makina and customers based on agreements in the scope of carrying out commercial operations of Lineer Makina.

It is transferred with the purpose of planning and carrying out the commercial operations of Lineer Makina and with the purpose of supplying goods/service from the suppliers or supplying goods/service to customers by considering necessity and proportion.

Legally Capable Public Institutions and Organizations

Public Institutions and Organizations which are authorized to collect information and documents from Lineer Makina according to related regulations

It is transferred limitedly with the purpose of the demand of related public institutions and organizations with their legal capability by considering necessity and proportion

Legally Capable Private Entity

Private entities which are authorized to collect information and documents from Lineer Makina according to related regulations

It is transferred limitedly with the purpose of the demand of related private entities with their legal capability by considering necessity and proportion.

 

 

 

 

 

 

 

 

  1. PERSONAL DATA AND DATA CATEGORIES

In case personal data of real persons in the scope of PVP Policy such as the major ones mentioned in the following are required by Lineer Makina, they are able to be processed partially or completely in a nonautomatic way.

Personal Data Categories

 

Personal Identifying information

Documents such as driving license, identity card, passport that contain information such as photograph, name-surname, T.R. Identity number, nationality, name of mother-father, birth place, date of birth, gender and information such as tax number, social security number, signature information, vehicle plate.

Contact Information

Personal information which are used for communication such as telephone number, address, e-mail.

Employee Candidate Information

Personal data related to individuals who are applied as Lineer Makina employee and evaluated as employee candidate as required by the practice and righteousness rules of business life according to the needs of Lineer Makina human resources.

Family Members, Relative Information and Personal File

Personal data about the family members (such as spouse, mother, father, child) and relatives which are kept with the purpose of protecting the benefits of personal data owner whose labor agreement is terminated with Lineer Makina with any reason and Personal Data which are required to be kept in the personal file for a certain period which is determined by the law and required by practice and righteousness rules of business life.

Physical Location, Security Information

Personal data related to records and documents taken during entrance to a physical location or staying in the physical location: Camera records, finger print records and records taken at security point.

Process Safety Information

Personal data such as IP information, login records which processed during the use internet-based software and personal data which is processed for providing technical, legal and commercial security of personal data owner or Lineer Makina as Lineer Makina carries out its commercial operations

Financial Information

Personal data such as personal data processed related to information, document and records and bank account number, IBAN, credit card information, income information which are created in the scope of legal relation between Lineer Makina and personal data owner.

Legal Transaction and Harmonization Information

Personal data which are processed in the scope of harmonization of determination of and rights, tracking and exercise of debts of Lineer Makina and legal responsibilities with Lineer Makina policies.

Audit and Inspection Information

Personal data which are processed in the scope of harmonization of legal responsibilities and policies Lineer Makina

Special Quality Personal Data

Data related to race, origin, political view, philosophical thought, religion, sect or other beliefs, dress, society, foundation or union membership, health, sexual life, conviction and safety precautions, and biometric and genetic data.

Demand/Complaint Management Information

Personal data related to receipt and evaluation of all kinds of demand and complaint directed at Lineer Makina

Reputation Management Information

Personal data which is associated with person and is collected to protect the business reputation of Lineer Makina

Event Management Information

Information or assessment which are associated with personal data owner and are collected related to events which have potential to affect Lineer Makina employees and shareholders (such as information and assessment collected related to leading public or investors correctly)

 

  1. DISPOSAL OF PERSONAL DATA                                                                                                      

Even though being processed in accordance with the provisions of law, except the obligations that arise from laws, in case the reasons to process the data cease to exist, personal data is disposed by Lineer Makina accordance with the regulations automatically or upon the request of the related person.

  1. RIGHTS OF PERSONAL DATA OWNERS AND REFERRING TO DATA SUPERVISOR
    1. Rights of Personal Data Owners:

In regard of gathered personal and special quality personal data of Data Owners by Lineer Makina, Data Owners have right to;

  • Learn whether their personal data is processed or not, and to demand information if processed.
  • Learn whether their personal data are used relevantly or not,
  • Learn who are the third parties the data transferred to in the country or at abroad if any,
  • Demand the correction of personal data if it is missing or wrong and demand that the transaction carried out in this context is notified to third parties who the data is transferred to,
  • Demand the disposal of processed data in case the reasons that requires personal data process cease to exist and demand notification of this demand to third parties who the data is transferred to,
  • Object to a result against himself/herself that arise from analyzing of data exclusively by automatic systems,
  • Demand to compensation of damages in case he/she suffer damages due to process of data unlawfully.

 

  1. Application to Data Supervisor

Reserving the other methods which will be determined by PVP Council, Data Owners are obligated to make their applications to Data Supervisors in writing in accordance with the Law. Related people will be able to deliver their demands related to rights stated above by using the application form in the annex of this Policy to Lineer Makina who is the Data Supervisor.

Accordingly, Personal Data Owner application can be sent to email address with an electronic signature or documents that prove their identity and signature or can be delivered in person with a petition with wet signature or can be sent through notary.

Data Supervisor: Lineer Hidrolik Pnömatik Elektrik Elektronik Makine Ltd. Şti. 

E-mail: info@lineermakina.com

Address for delivery in person or through notary: Karpuzsekisi Mah. 6071 Sk. No: 4-A, Hacılar/Kayseri

Lineer Makina with the title of Data Supervisor replies to demands of data owners related to personal data in thirty (30) days at most according to the nature of the demand and for free of charge as a rule. In case the demand requires an additional cost, the fee which is determined by PVP Council will be reflected to Data Owner.

Lineer Makina has right to accept or reject the demand by explaining the reason after examining the demand. The reason of rejection is notified to applicant in writing or in electronic environment. In case the demand is accepted, Lineer Makina carries out what the demand requires.

Lineer Makina can demand some additional information/documents and ask some questions to exercise the right of the person who make the application in the scope of providing data, in accordance with Lineer Makina policy/procedures and/or provisions of the Law. The demand can be rejected by Lineer Makina by stating the reason in case the application of Data Owner has possibility to obstruct the rights or freedoms of other people, requires unreasonable effort or if the information is public.

 

  1. CIRCUMSTANCES IN WHICH DATA OWNERS CANNOT EXERCISE THEIR RIGHTS
    1. In case the following reasons exist, data owners have no right to make any demands in accordance with regulations of Law.
  • In case the personal data is processed with purposes art, historic literature or scientific purposes or in the scope of freedom of expression in case it doesn’t violate national defence, national security, public safety, economic security, confidentiality of private life or personal rights or doesn’t constitute a crime.
  • In case the personal data is processed with the purposes of research, planning and statistics by making them anonymous with formal statistic.
  • In case personal data is processed in the scope of preventive, protective and informative operations which are carried out by public institutions and organizations which are authorized and assigned by law related to provide national defence, national security, public safety, public order or economic safety.
  • In case personal data is processed by judicial offices or prosecution authorities related to investigation, prosecution, trial or execution transactions.

11.2

In case of the conditions stated in the following exist, personal data owners cannot claim their rights in scope of the Law except demanding compensation of damages;

  • Personal data is required to prevent crime or for a crime investigation,
  • If personal data which is processed is made public by the Data Owner,
  • Personal data process is required to carry out audit and regulation duties and disciplinary investigation and prosecution by professional organizations with public institution status and authorized public institutions and organizations which are authorized by the law.
  • Personal data process is required to protect the financial interests of the government related to budget, tax and financial affairs.