Personal Data Processing

Policy on the Processing, Storage, and Destruction of Personal Data

AloTech, with this Policy on the Processing, Storage, and Destruction of Personal Data (“Policy”) published at https://alotech.com.tr/kisisel-verilerin-islenmesi-politikasi, declares that it is responsible as a data controller under the Law on the Protection of Personal Data No. 6698.

AloTech places great importance on the processing and preservation of your personal data in accordance with the Law on the Protection of Personal Data No. 6698 and other relevant legislation. With this awareness, AloTech processes and preserves personal data in compliance with the legislation to fulfill its legal obligations and carry out activities consistent with its field of business.

1. Purpose and Scope

The purpose of this Policy is to explain the principles adopted by AloTech for the processing and protection of personal data in accordance with the Law, and its storage and destruction in accordance with the Regulation, and the methods to be followed in this context.

This Policy applies to all activities managed by AloTech regarding the processing, protection, storage, and destruction of all personal data processed by AloTech through fully or partially automated means or non-automated means provided that they are part of a data recording system. This includes, but is not limited to, personal data belonging to officials, employees, former employees, employee candidates, interns, visitors of AloTech and its affiliated group(s), other companies, direct and indirect subsidiaries and affiliates, as well as officials and employees of collaborating institutions and organizations, and third parties from whom services are procured or to whom services are provided in relation to its field of business, both domestically and internationally.

2. Principles Regarding the Processing and Transfer of Personal Data

2.1 Principles Underlying the Processing of Personal Data

AloTech processes personal data within the scope of this Policy in accordance with the following general principles, pursuant to Article 4 of the Law.

• Compliance with the law and principles of fairness
• Being accurate and up-to-date when necessary
• Processing for specific, explicit, and legitimate purposes
• Being relevant, limited, and proportionate to the purpose for which they are processed
• Being retained for the period stipulated by relevant legislation or required for the purpose for which they are processed

2.2 Conditions for Processing Personal Data

AloTech processes personal data with the explicit consent of the data subject. It is also possible for AloTech to process personal data without the explicit consent of the data subject in the cases specified under Article 5 of the Law, namely: (i) it is expressly provided for by the laws, (ii) it is necessary for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not legally valid, (iii) processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, (iv) it is necessary for compliance with a legal obligation to which the data controller is subject, (v) the data has been made public by the data subject himself/herself, (vi) data processing is necessary for the establishment, exercise or protection of any right, (vii) processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

AloTech does not process special categories of personal data without the explicit consent of the data subject. However, it is possible to process the data subject’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, criminal convictions and security measures, as well as biometric and genetic data without the explicit consent of the data subject in cases prescribed by law.

2.3. Purposes of Processing Personal Data

Personal data is processed by AloTech for the following purposes in accordance with the principles and conditions specified in Articles 2.1 and 2.2 of this Policy.

A – Within the scope of job applications, planning and monitoring human resources processes for employee candidates and interns, carrying out candidate/intern selection and placement processes, executing application processes for employee candidates, planning human resources processes, and conducting talent/career development activities,

B – Within the scope of Human Resources processes, carrying out procedures related to the payroll and personal rights of employees and interns, making legal notifications, monitoring health insurance processes, planning employee rights and benefits, conducting employee satisfaction and loyalty processes, fulfilling contractual and legal obligations, executing fringe benefits and interests processes, conducting performance evaluation processes, conducting talent/career development activities, determining salary policies, executing assignment processes, monitoring work and residence permit processes for foreign personnel, and providing information to authorized persons, institutions, and organizations,

C – Within the scope of planning and executing activities necessary for recommending and promoting the products and services offered by customizing them according to the tastes, usage habits, and needs of third parties, planning and/or executing customer satisfaction activities, planning and/or executing market research and marketing activities and processes related to products and services, and planning and/or executing relevant processes to obtain the maximum benefit from the products or services offered,

D – Within the scope of the work carried out by the relevant business units to enable third parties to benefit from the products and services offered by AloTech and the execution of related business processes, planning and/or executing the sales processes of products and/or services, planning and/or executing after-sales support services, planning and/or executing customer relationship management processes, tracking customer requests and complaints, and tracking contract processes and/or legal claims,

E – Within the scope of ensuring the legal, technical, and commercial-business security of AloTech and the related persons in a business relationship with it; planning and/or executing audit activities, planning and executing necessary operational activities to ensure that activities are carried out in accordance with company procedures and/or relevant legislation, ensuring the security of operations, ensuring that data is accurate and up-to-date, and providing information to authorized institutions arising from legislation,

F – Within the scope of carrying out the necessary work by the relevant business units for the realization of commercial activities conducted by AloTech and executing the related business processes, planning, auditing, and executing information security processes, creating and managing information technology infrastructure, tracking finance and/or accounting affairs, tracking legal affairs, planning and/or executing activities for the analysis of the efficiency/productivity and/or appropriateness of business activities, planning and executing business activities, planning and executing corporate communication activities, planning and executing logistics activities, and planning and executing operational processes,

G – Within the scope of planning and executing AloTech’s commercial and/or business strategies, managing relationships with business partners, customers, and/or suppliers, executing strategic planning activities, and planning and monitoring the performance evaluation processes of business partners and/or suppliers,

H – Ensuring the security of physical premises, and ensuring the security of movable property and resources,

I – Ensuring the continuity of AloTech’s activities, carrying out finance and accounting affairs, tracking and executing legal affairs, conducting internal audit/investigation/intelligence activities, conducting communication activities, conducting management activities, organizing and managing events, and managing access authorizations.

2.4. Transfer of Personal Data

Within the scope of the services provided by AloTech and the employer-employee relationship, personal data is shared with insurance companies, service procurement and provision companies and their employees, software firms, domestic and foreign banks and financial institutions, licensed payment institutions, domestic and foreign organizations from which services are received for storing and protecting data in the cloud and similar environments, domestic and foreign organizations from which server services are received, domestic and foreign organizations from which services are received for sending commercial electronic messages, the Interbank Card Center (BKM), advertising and communication agencies, credit card service providers, payment service providers, internet service providers, mobile application and website software maintenance and support service providers, AloTech’s shareholders, other companies of the group or groups to which it is affiliated, its direct and indirect subsidiaries and affiliates, including but not limited to AloTech’s domestic and foreign business and solution partners, and third-party natural and legal persons with whom it has a contractual relationship, in line with AloTech’s field of business, limited to the information they will use within the scope of their activities.

AloTech also shares personal data with judicial, administrative, or other official authorities to whom it is legally obligated to provide information. The purpose of these data sharing activities is to provide the services offered by AloTech securely, uninterruptedly, and with high quality, and to fulfill legal obligations.

During the transfer of personal data, AloTech takes all necessary measures to ensure an appropriate level of security in accordance with the legislation to prevent the unlawful use of data and to ensure its preservation.

3. Categorization of Personal Data

AloTech may process the personal data of the data subject, which clearly belongs to an identified or identifiable natural person, partially or fully automatically, or non-automatically as part of a data recording system, in accordance with the principles and conditions specified in Articles 2.1 and 2.2 of this Policy.

AloTech processes the personal data of data subjects—including primarily its employees, former employees, employee candidates, interns, visitors, employees and officials of collaborating institutions and organizations, and third parties from whom it procures or provides services related to its field of business—within the framework of employer-employee relationships, service relationships, and AloTech’s business activities and contracts, in the following categories:

• Identity
• Contact
• Personnel
• Legal Transaction
• Physical Space Security
• Transaction Security
• Finance
• Professional Experience
• Visual and Auditory Records
• Health Information
• Race and Ethnic Origin
• Religion
• Criminal Conviction

4. Purposes and Reasons for Storing Personal Data

AloTech stores the personal data covered by this Policy for the purposes stated in Article 2.3 of this Policy, due to the obligations imposed on it by the Constitution of the Republic of Turkey and the relevant laws, regulations, statutes, and all other legal legislation, as well as the relevant legal regulations to which the group or groups it is affiliated with and its direct and indirect subsidiaries and affiliates are subject.

5. Environments Where Personal Data is Stored

AloTech stores personal data in a suitable recording medium in accordance with the type and nature of the relevant data, in line with the principles and conditions specified in the Law and Regulation, and the obligations imposed on it as a data controller under the legislation, primarily the Law and Regulation.

In this context, AloTech securely stores personal data physically in printed media, primarily paper; and digitally in electronic environments such as databases, cloud environments, e-mail, websites, software, computers, mobile devices, CDs, DVDs, and flash drives.

6. Destruction of Personal Data

6.1 Purposes and Reasons for the Destruction of Personal Data

AloTech destroys the personal data it processes, either ex officio or upon the request of the data subject, by deleting, destroying, or anonymizing it in accordance with the periods specified in this Policy, in cases where the reasons requiring its processing cease to exist, pursuant to the Law and Regulation.

In this context:

a. Amendment or repeal of the relevant legislative provisions that form the basis for processing personal data,

b. The contract between the parties was never established, is not valid,

c. The contract terminates automatically, is terminated, or is rescinded,

d. The purpose requiring the processing of personal data ceases to exist,

e. It is determined that the processing of personal data is unlawful or contrary to the principle of fairness,

f. In cases where the processing of personal data is based solely on explicit consent, the data subject withdraws their consent,

g. The data controller accepts the application made by the data subject regarding the personal data processing activity within the framework of their rights in paragraphs (e) and (f) of Article 11(1) of the Law,

h. The data controller rejects the application made by the data subject for the deletion or destruction of their personal data, finds the response insufficient, or does not respond within the period prescribed by the Law; a complaint is filed with the Board and this request is found to be appropriate by the Board,

i. The maximum period for retaining personal data has passed, and there are no conditions that justify retaining the personal data for a longer period,

j. The conditions requiring the processing of personal data in Articles 5 and 6 of the Law cease to exist,

personal data will be destroyed by AloTech by deleting

For updating, correcting personal data held by AloTech, and for any other questions, requests, and opinions regarding personal data, AloTech can always be reached through the methods set out in the AloTech Data Subject Application Form available at https://alotech.com.tr/basvuru-formu. Applications are evaluated and concluded as soon as possible and within 30 (thirty) days at the latest after being communicated to AloTech. However, if the transaction requires an additional cost, AloTech reserves the right to charge a fee based on the tariff determined by the Board.