• +90 216 784 0045
  • info@hazirangroup.com
  • Blog
Instagram Linkedin-in

Policy on the Protection and Processing of Personal Data

 

1. INTRODUCTION

1.1. Purpose and Scope

The Personal Data Protection Law No. 6698 (“Law”) entered into force on April 7, 2016. This Personal Data Protection and Processing Policy (“KVK Policy”) of HAZIRAN GRUP TEKSTIL SANAYI VE DIS TICARET LIMITED SIRKETI (“Company” or “HAZIRAN”) has been prepared and implemented to ensure compliance with the Law and to establish the principles to be followed in fulfilling the obligations of HAZIRAN regarding the protection and processing of personal data.

This KVK Policy sets out the conditions for processing personal data and the main principles adopted by HAZIRAN in processing personal data. Accordingly, the KVK Policy covers all personal data processing activities carried out by the Company in relation to persons other than HAZIRAN employees and all data subjects whose personal data are processed by HAZIRAN. Matters regarding the processing of personal data of HAZIRAN employees are regulated separately in the Employee Personal Data Protection and Processing Policy of HAZIRAN GRUP TEKSTIL SANAYI VE DIS TICARET LIMITED SIRKETI.

1.2. Enforcement and Amendments

This KVK Policy is valid as of the date it has been approved and entered into force by HAZIRAN. The Company reserves the right to amend the KVK Policy in line with legal regulations.

In case of any conflict between this KVK Policy and the applicable legislation, primarily the Law, the provisions of the applicable legislation shall prevail.

2. DATA SUBJECTS, PURPOSES OF DATA PROCESSING, AND DATA CATEGORIES

2.1. Data Subjects

Within the scope of this KVK Policy, the data subjects are all natural persons whose personal data are processed by HAZIRAN, excluding HAZIRAN employees. In this context, data subject categories generally include:

DATA SUBJECT CATEGORIES

DESCRIPTION

Visitor

Refers to natural persons visiting the Company’s buildings, premises, and website.

Employee Candidate

Refers to natural persons who have applied for a job at the Company or organizations supported by the Company.

Company Official

Refers to members of the Company’s board of directors and other authorized natural persons.

Employees, Shareholders, or Officials of Institutions/Companies in Business Relationship

Refers to employees, shareholders, or officials of institutions with which the Company has any business relationship (e.g., suppliers, business/solution partners, subcontractors, dealers, etc.).

Third Parties

Refers to natural persons subject to the Company’s personal data processing activities other than the above categories and Company employees.

2.2. Purposes of Processing Personal Data

Personal data and special categories of personal data may be processed by HAZIRAN in compliance with the data processing conditions set out in the Law and relevant legislation, for purposes including but not limited to:

  • Human resources operations (e.g., recruitment, training)

  • Ensuring the legal, technical, and commercial security of the Company and related parties

  • Strategic planning, corporate communication, and business activities

  • Auditing, legal compliance, and occupational health & safety

  • Finance, accounting, and IT infrastructure management

  • Event and visitor management, emergency planning

2.3. Personal Data Categories

The following categories of personal data may be processed by HAZIRAN in compliance with the Law:

  • Identity Information

  • Contact Information

  • Physical Security Information

  • Financial Information

  • Employee Candidate Information

  • Legal Transaction and Compliance Information

  • Transaction Information

  • Visual and Audio Data

  • Vehicle Information

  • Request/Complaint Management Information

  • Audit and Inspection Data

  • Special Category Personal Data (race, religion, health data, biometric data, etc.)

3. PRINCIPLES AND CONDITIONS FOR PROCESSING PERSONAL DATA

  • Lawful and fair processing

  • Accuracy and up-to-dateness

  • Processing for specific, explicit, and legitimate purposes

  • Relevance, limitation, and proportionality

  • Retention for as long as required by law or processing purpose

Conditions for processing include explicit consent, legal obligation, contractual necessity, public disclosure, protection of vital interests, legal claims, and legitimate interests, provided fundamental rights are not violated.

Special category data (sensitive data) may only be processed under strict legal conditions and with additional safeguards.

4. TRANSFER OF PERSONAL DATA

HAZIRAN may transfer personal data to third parties in Turkey or abroad if conditions specified in Articles 8 and 9 of the Law are met, including:

  • Business partners (e.g., banks, service providers, audit firms, legal advisors)

  • Suppliers (providing contractual services)

  • Authorized public institutions

  • Authorized private entities (e.g., independent auditors)

Transfers abroad require either adequate protection in the recipient country or written undertakings with approval of the Personal Data Protection Authority.

5. DATA SUBJECT INFORMATION AND RIGHTS

In accordance with Article 10 of the Law, data subjects must be informed at or before data processing.

Data subjects have rights under Article 11, including:

  • Learning whether their data are processed

  • Requesting information and correction

  • Knowing transfer recipients

  • Requesting deletion, destruction, or anonymization

  • Objecting to decisions based on automated systems

  • Claiming compensation for damages

Applications may be made to HAZIRAN through the Data Subject Application Form on the website.

6. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

As per Article 7 of the Law, even if processed lawfully, personal data shall be deleted, destroyed, or anonymized when the reasons requiring processing cease to exist, following retention schedules and Company’s Personal Data Retention and Destruction Policy.