GDPR & Privacy Policies

İŞİNOLACAK BİLGİ TEKNOLOJİLERİ YAPAY ZEKA İNSAN KAYNAKLARI TİC. SAN. A.Ş.

PERSONAL DATA PROCESSING AND PROTECTION POLICY

1. INTRODUCTION

İşinolacak Bilgi Teknolojileri Yapay Zeka İnsan Kaynakları Tic. San. A.Ş. (the “Company”) demonstrates the utmost sensitivity in ensuring full compliance with the Law on the Protection of Personal Data No. 6698 (“Law”) and other regulations implemented in accordance with this Law. In this context, all employees are responsible for taking and implementing appropriate security measures.

Regulating the internal operations of the COMPANY in accordance with the Law, secondary regulations, guides, decisions and regulations issued by the Personal Data Protection Authority, and communiqués is among the COMPANY’s top priorities.

2. PURPOSE

Herein Personal Data Protection and Processing Policy (“Policy”) of İşinolacak Bilgi Teknolojileri Yapay Zeka İnsan Kaynakları Tic. San. A.Ş. has been established to ensure the Company’s compliance with the Law on the Protection of Personal Data No. 6698 and the secondary regulations enacted pursuant to this Law.

The purpose of this Policy is to ensure compliance with the regulations regarding the protection of personal data, to determine the internal operating rules and responsibilities of the COMPANY, to evaluate matters related to the processing and protection of the confidentiality of information obtained within the scope of the COMPANY’s activities, and to define strategies, internal controls and precautions, operating rules and responsibilities, as well as to inform personal data subjects and COMPANY employees.

In line with the fundamental regulations stipulated by the Law, the COMPANY takes necessary administrative and technical measures regarding the processing and protection of personal data within its operations, establishes internal procedures, organizes relevant training sessions to raise awareness, takes necessary measures to ensure compliance of employees with personal data protection processes, and sets up suitable and effective audit mechanisms along with a technological infrastructure and administrative and legal systems.

3. SCOPE

This Policy applies to all Personal Data processed by automatic means or by non-automatic means, provided that they are part of any data recording system, concerning the COMPANY, its subsidiaries, and foreign branches and subsidiaries, provided that the legislation in the countries where they operate allows for such processing, including the COMPANY’s customers, potential customers, employees, employee candidates, shareholders, visitors, institutions and organizations with which the COMPANY has a contractual relationship (e.g., support services, appraisal, independent audit, rating, consultancy, service, procurement, cooperation, etc.) and their employees, shareholders and officials, as well as third parties.

All activities to be carried out and measures to be taken within the COMPANY under this Policy are determined through the relevant procedures.

4. DEFINITIONS

Explicit Consent: Consent that is related to a specific subject, based on information and expressed with free will.

Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.

Relevant User: Persons who process personal data within the data controller's organization or in line with the authority and instructions received from the data controller, excluding those responsible for the technical storage, protection, and backup of data.

Destruction: The deletion, destruction, or anonymization of personal data.

Law: The Law on the Protection of Personal Data No. 6698.

Personal Data Subject / Relevant Person: Customers or non-customer individuals whose personal data are processed, including potential customers, employees, employee candidates, shareholders, visitors, institutions and organizations with which the COMPANY has a contractual relationship (e.g., support services, independent audit, rating, consultancy, service, procurement, cooperation, etc.) and their employees, shareholders, and officials, and other third natural persons.

Personal Data: Any information relating to an identified or identifiable natural person.

Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use thereof, wholly or partly by automatic means or by non-automatic means provided that it is part of any data recording system.

Personal Data Processing Inventory: The inventory prepared by the COMPANY based on its business processes, detailing the personal data processing activities, purposes and legal grounds for processing, data categories, recipient groups to whom the data is transferred, data subject groups, maximum retention periods, data transferred abroad, and the security measures taken.

Board: The Personal Data Protection Board.

Authority: The Personal Data Protection Authority.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller.

Data Recording System: A recording system in which personal data is structured according to specific criteria.

Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Data Controllers’ Registry Information System (VERBIS): The information system created and managed by the Presidency, accessible via the internet, which data controllers shall use to apply for and carry out other transactions regarding the Registry.

5. RESPONSIBILITIES

5.1. Board of Directors

Responsible for the management, establishment of the scope and framework of the Personal Data Protection and Processing Policy, and for its regular review.

5.2. Personal Data Committee

Monitors compliance with the relevant regulations on personal data protection and the internal policies and practices of the COMPANY.

Provides assurance to the Board of Directors on the adequacy and effectiveness of the governance framework concerning personal data protection.

5.3. Senior Management

Responsible for the implementation of the Personal Data Protection and Processing Policy within the COMPANY.

Structures subordinate management levels and business processes in compliance with data protection regulations.

Plays an active role in establishing and maintaining a working environment that supports personal data protection.

5.4. Contact Person

Ensures communication with the Personal Data Protection Authority and responds to requests from relevant persons.

6. PERSONAL DATA

Personal data refers to any information relating to an identified or identifiable natural person. To qualify as personal data, the information must relate to a real person and such person must be identified or identifiable. Accordingly, personal data pertains to natural persons, and data relating to legal persons fall outside the scope of the definition of personal data.

Identifiable or identified person: Personal data may directly reveal the identity of the relevant person or, although not directly revealing the identity, may allow for the person’s identification through association with any record.

Any kind of information: This expression covers a broad range of data, not only those that disclose the identity of a person such as name, surname, date and place of birth, but also data such as telephone number, license plate number, social security number, passport number, résumé, photos, video and audio recordings, fingerprints, email address, hobbies, preferences, contacts, group memberships, family information, health information – all of which may directly or indirectly identify a person.

7. PROCESSING OF PERSONAL DATA

Processing of personal data refers to any operation performed on personal data such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use thereof, wholly or partly by automatic means or by non-automatic means provided that it is part of any data recording system.

Automatic Processing: Processing activities carried out by devices with processors such as computers, phones, watches, etc., which operate autonomously based on pre-defined algorithms via software or hardware features, without human intervention.

Non-Automatic Processing: Even if personal data are not subject to automatic processing, if they are processed through a “data recording system,” the provisions of the Law shall still apply.

8. GENERAL PRINCIPLES OF PROCESSING PERSONAL DATA

The COMPANY always complies with the general principles set forth in the Law regarding the processing of personal data. The general principles for processing personal data are as follows:

Compliance with law and good faith,

Accuracy and, where necessary, being up to date,

Processing for specified, explicit, and legitimate purposes,

Being relevant, limited, and proportionate to the purposes for which they are processed,

Being retained for the period stipulated by relevant legislation or required for the purpose for which they are processed.

8.1. Compliance with Law and Good Faith

The processing of personal data by the COMPANY is carried out in accordance with all applicable legislation, primarily the Regulation on Private Employment Agencies and the Law on Protection of Personal Data, as well as the principle of good faith stipulated in Article 2 of the Turkish Civil Code.

8.2. Accuracy and Being Up to Date Where Necessary

The COMPANY ensures that the personal data it processes is accurate and up to date, taking into account the fundamental rights and legitimate interests of the data subjects. In this context, the COMPANY keeps channels open to ensure the accuracy and timeliness of personal data. It also carefully considers issues such as verifying the reliability of data sources and assessing whether updates are necessary.

8.3. Processing for Specified, Explicit, and Legitimate Purposes

The COMPANY clearly and definitively determines the purpose of data processing and ensures that this purpose is legitimate. Accordingly, personal data is processed only in connection with the products/services offered (or to be offered) by the COMPANY and its legal obligations. The purposes for which personal data will be processed are determined before the processing activity begins.

8.4. Being Relevant, Limited, and Proportionate to the Purpose

The COMPANY processes personal data only to the extent necessary for the intended purpose and avoids processing data that is irrelevant or unnecessary for achieving that purpose. Personal data processing is limited to the COMPANY’s activities and legal obligations.

8.5. Retention for the Period Stipulated by Law or Required for the Purpose

The COMPANY complies with retention periods stipulated by applicable laws. If no legal retention period exists, personal data is retained only for as long as necessary for the processing purpose. If there is no valid reason to retain personal data further, it is deleted or anonymized.

9. CONDITIONS FOR PROCESSING PERSONAL DATA

9.1. Explicitly Provided by Law

If explicitly permitted by law, personal data may be processed without the data subject’s consent, provided that the processing does not exceed legal limits.

9.2. Physical Impossibility

If obtaining consent is physically impossible or legally invalid, personal data may be processed to protect the life or physical integrity of the data subject or another person.

9.3. Necessity for Contract Execution

Personal data may be processed if necessary for the establishment or performance of a contract, provided that the processing is limited to this purpose.

9.4. Legal Obligation

The COMPANY processes personal data to fulfill legal obligations, strictly within the limits of such obligations.

9.5. Data Subject’s Public Disclosure of Personal Data

If the data subject has made their personal data public, the COMPANY may process such data in proportion to the purpose of disclosure.

9.6. Necessity for Establishing, Exercising, or Protecting a Right

Personal data may be processed if necessary to establish, exercise, or protect a legal right.

9.7. Legitimate Interest of the COMPANY

Personal data may be processed if necessary for the COMPANY’s legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject.

9.8. Explicit Consent of the Data Subject

If none of the above conditions apply, the COMPANY may process personal data based on the explicit consent of the data subject, which must be freely given, specific, and informed.

10. PROCESSING CONDITIONS FOR SPECIAL CATEGORIES OF PERSONAL DATA

• Under Article 6 of the Law, certain personal data that poses a risk of harm or discrimination if processed unlawfully is classified as "special categories", including:

• Race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs,

• Appearance and dress,

• Association, foundation, or trade union membership,

• Health, sexual life,

• Criminal convictions and security measures,

• Biometric and genetic data.

The COMPANY processes special categories of personal data only under the following conditions, in compliance with the Law and with adequate precautions determined by the Board:

10.1. Explicitly Provided by Law

If explicitly permitted by law, such data may be processed without consent, within legal limits.

10.2. Physical Impossibility

If consent cannot be obtained due to physical impossibility or legal invalidity, processing is permitted to protect life or physical integrity.

10.3. Data Subject’s Public Disclosure

If the data subject has made such data public, it may be processed proportionally to the disclosure purpose.

10.4. Necessity for Establishing, Exercising, or Protecting a Right

Processing is permitted if necessary to establish, exercise, or protect a legal right.

10.5. Healthcare Planning, Management, and Financing

Special data may be processed for public health protection, medical diagnosis, treatment, healthcare services, and financing, by authorized persons/institutions under confidentiality obligations.

10.6. Legal Obligation in Employment, Social Security, etc.

Processing is permitted if necessary for legal obligations in employment, occupational health and safety, social security, or social services.

10.7. Membership in Associations, Foundations, or Unions

Data may be processed if related to membership in non-profit organizations, provided it aligns with their legal purposes and is not disclosed to third parties.

10.8. Explicit Consent of the Data Subject

If no other condition applies, processing requires the explicit consent of the data subject.

11. TRANSFER OF PERSONAL DATA

11.1. Domestic Transfers

Personal data may be transferred domestically if the conditions under Articles 9.1–9.7 are met.

11.2. International Transfers

Personal data may be transferred abroad only if:

• The recipient country has an adequacy decision from the Board, or

• If no adequacy decision exists, appropriate safeguards (e.g., standard contracts, written commitments, binding corporate rules) are in place.

• In exceptional cases, transfers may occur based on:

• Explicit consent,

• Contract performance,

• Public interest,

• Establishment of a legal right,

• Protection of life/physical integrity,

• Public registry disclosures.

12. DELETION, DESTRUCTION, OR ANONYMIZATION OF PERSONAL DATA

The COMPANY retains personal data for legally required periods. After the purpose expires, data is deleted, destroyed, or anonymized within 1 year (either periodically or upon request).

13. OBLIGATIONS OF THE COMPANY

13.1. Informing Data Subjects

The COMPANY informs data subjects about:

• The identity of the data controller,

• Processing purposes,

• Recipients of data,

• Collection method and legal basis,

• Rights of the data subject.

13.2. Data Security Measures

The COMPANY takes technical and administrative measures, including:

• Preventing unlawful processing/access,

• Employee training,

• Access restrictions,

• Confidentiality agreements,

• Secure storage and backups,

• Notification of breaches to the Board/data subjects.

14. RIGHTS OF THE DATA SUBJECT

Under Article 11 of the Law, data subjects have the right to:

• Learn whether their data is processed,

• Request information on processing,

• Know the purpose and whether it is used accordingly,

• Identify third-party recipients (domestic/international),

• Request correction of inaccurate data,

• Request deletion/destruction (if legal conditions are met),

• Object to automated decision-making,

• Claim compensation for damages due to unlawful processing.

15. APPLICATION METHODS

Data subjects may submit requests:

• In person (with ID) at:

• Kozyatağı Mah. Saniye Ermutlu Sk. By Otell No: 3c, Kadıköy/İstanbul

• Via notary,

• Via secure e-signature to: [email protected]

• Via registered e-mail to: [email protected]

• The COMPANY responds within 30 days (free of charge unless additional costs apply).

16. COMPLIANCE WITH BOARD DECISIONS & IMPACT ASSESSMENTS

The COMPANY has a dedicated unit to ensure compliance with the Law and conducts data protection impact assessments for new products/processes.

17. EFFECTIVE DATE

This policy enters into force upon approval by the Board of Directors.