REGARDING THE PROTECTION OF PERSONAL DATA 

EMPLOYEE CLARIFICATION TEXT

The Data Controller:  Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. (Address: Hadımköy Mahallesi İbni Sina Caddesi No:8/5 ARNAVUTKÖY/İSTANBUL Tel: 0212 674 16 25  Website: www.cagdaskagit.com, E-mail: [email protected] Mersis No: 0217038013300019) has issued and announced this clarification text to inform employees about the procedures and principles to be followed in protecting personal data within the scope of the Law on the Protection of Personal Data No. 6698 (hereinafter referred to as "KVKK") and the Regulation on the Principles and Procedures to Fulfill the Obligation to Inform (hereinafter referred to as "Regulation").

KVKK Article 10; “During the acquisition of personal data, the data controller or the authorized person must provide the relevant individuals with information regarding: the identity of the data controller or its representative, the purposes of processing personal data, to whom and for what purposes the processed personal data may be transferred, the method and legal reason for collecting personal data, and other rights specified in Article 11.”

BASIC DEFINITIONS IN THE LAW

 

Personal Data : Any information related to an identified or identifiable real person.

Processing of Personal Data : Any operation performed on personal data, whether or not by automatic means, such as collecting, recording, storing, retaining, altering, organizing, 

disclosing, transferring, taking over, making retrievable,

classifying, or preventing the use of such data.

Data Controller : A real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. In this document, the Data Controller is Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti., located at Hadımköy Mahallesi İbni Sina Caddesi No:8/5 ARNAVUTKÖY/İSTANBUL.

Data Recording System (VERBİS): A recording system in which personal data is processed by structuring them according to certain criteria.

Explicit Consent : Consent based on information and freely expressed will regarding a specific matter.

Board : Refers to the Personal Data Protection Board.

 

PERSONAL DATA RELATED TO EMPLOYEES

Personal data related to employees may be processed by our company in accordance with the purposes and processing conditions specified in this text. The personal data subject to processing are as follows: 

 

1. Identity Data

Name, surname, mother's and father's name, mother's maiden name, date of birth, T.C. ID number, gender, marital status, ID card serial number, nationality information, passport information, job and title information, family members' information.

 

1. Contact Data

Phone number, email address, address information, internal company contact information (company phone number, internal phone number, corporate email address, registered email address).

 

1. Financial Data

Bank IBAN number, payrolls, files and debt information related to enforcement files.

 

1. Professional Experience Data

Education level, in-service training information, certificate and diploma information, language skills, courses attended, education and skills, work experience, transcript information.

 

1. Visual and Auditory Data

Photos and camera recordings of the real person.

 

1. Personnel Data

Disciplinary investigations, employment entry and exit records, CV information, performance evaluation reports, insurance information, criminal record, leave departure and return dates, department, and unit.

 

1. Health Data

Health reports, blood type, personal health information, health and maternity leave documents, information on disability status, devices, and prostheses used.

 

1. Other Data

IP address information on corporate computers, website access logs on corporate computers, vehicle license plates, accommodation and travel information, fingerprints, handwriting, and signature, request, and complaint information.

 

PURPOSE OF PROCESSING PERSONAL DATA BY ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. ŞTİ.

In accordance with Article 10 of KVKK and Article 5 of the Regulation, employees' personal data can be processed for the following purposes, in compliance with the processing conditions specified in Article 4 of KVKK:

• Fulfilling service obligations, fulfilling employer responsibilities, ensuring job safety, managing, supervising, and executing work as per the service agreement,
• Receiving and evaluating suggestions for improving business processes,
• Providing information about changes in our service terms,
• Resolving employee complaints and processing requests for data access or correction,
• Arranging all records and documents to serve as a basis for processing in electronic (internet/mobile, etc.) or physical environments,
• Carrying out contract processes within the scope of the Labor Law and other legislations,
• Providing information to public officials on matters of public safety upon request and as required by legislation,
• Fulfilling legal obligations and exercising rights arising from applicable legislation,
• Fulfilling legal obligations in case of a request and mandatory response by the relevant authority during judicial and administrative investigations,
• Conducting fringe benefits and benefits processes for employees,
• Fulfilling obligations arising from employment contracts and legislation for employees,
• Conducting training activities aimed at employee satisfaction,
• Conducting activities for employee training,
• Carrying out business activities,
• Carrying out occupational health and safety activities,
• Managing assignment processes,
• Carrying out internal audit activities,
• Conducting performance evaluation processes,
• Managing emergency management processes,
• Carrying out communication activities,
• Managing accounting and financial affairs,
• Organizing and managing events and activities,
• Conducting information security processes,
• Carrying out storage and archiving activities,
• Ensuring physical space security.

METHOD AND LEGAL BASIS OF COLLECTING PERSONAL DATA

Personal data can be obtained directly from the relevant person, third parties, and legal authorities during the establishment of a legal relationship. In this context, personal data can be collected orally, in writing, or electronically through tools such as email, application forms, and verbal or written communication channels. Personal data is collected in compliance with the Labor Law and other legislations to fulfill the employer's obligations under employment contracts and laws accurately and completely.

According to Article 5 of KVKK, personal data cannot be processed without the explicit consent of the relevant individual. The law specifies cases where explicit consent is not required as exceptions. In cases where there is an explicit provision in the law, the processing of personal data of the parties to a contract is mandatory for the establishment or execution of a contract, fulfilling the legal obligation of the company, the data is made public by the relevant person, processing the data is mandatory for the establishment, exercise, or protection of a right, or processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the individual, personal data may be processed by our company without explicit consent.

For Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to continue its activities, personal data may be processed under the conditions and purposes specified in Articles 5 and 6 of KVKK and in line with the principles and procedures foreseen by relevant legislations to achieve the purposes specified in this Clarification Text and fulfill legal obligations.

 

TO WHOM AND FOR WHAT PURPOSES PERSONAL DATA CAN BE TRANSFERRED

Employees' personal data may be shared, in line with the conditions and purposes of data transfer and processing specified in Articles 8 and 9 of the Law and the purposes listed above, with suppliers, shareholders, authorized dealers, private legal entities providing services (in areas such as security, training, auditing, events and organization, health, occupational safety, legal matters, etc.), independent audit firms, financial institutions, direct and indirect affiliates, domestic and international business partners, and companies providing storage, archiving, and IT support domestically and abroad (servers, hosting, programs, cloud computing), legally authorized public institutions, and private legal entities, and may be transferred abroad.

PERSONAL DATA RETENTION PERIOD

In compliance with the provisions of KVKK, your personal data processed for the purposes specified in this "Clarification Text on the Processing of Personal Data" will be deleted, destroyed, or anonymized when the purpose requiring processing no longer exists and/or when the statute of limitations for our legal obligations expires, in accordance with the Personal Data Retention and Destruction Policy.

RIGHTS OF THE DATA SUBJECT

The data subject has the right to learn whether their personal data is being processed, to request information if their personal data has been processed, to learn the purpose of processing and whether it is being used in accordance with its purpose, to know the third parties to whom their personal data has been transferred domestically or abroad, to request correction if the personal data has been processed incompletely or incorrectly, to request deletion or destruction of personal data in cases where the reasons for processing no longer exist, to request notification of third parties to whom personal data has been transferred when it is corrected, deleted, or destroyed, to object to results detrimental to themselves arising from the analysis of processed data exclusively through automated systems, and to claim compensation for damages incurred due to the unlawful processing of personal data.

EXCEPTIONS TO THE RIGHT TO APPLY

According to Article 28/2 of the Law, except for the right to claim compensation for damages, the data subjects may not benefit from the rights listed in Article 11 of the Law under the following circumstances: 

 

• When the processing of personal data is necessary for the prevention of a crime or for a criminal investigation,
• When the personal data has been made public by the data subject themselves.

 

APPLICATION METHOD AND FORM 

 

The data subject may submit their requests regarding the rights listed above to Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. in accordance with the application procedures stipulated in the Regulation on the Procedures and Principles of Applying to the Data Controller.

Requests regarding the rights listed in Article 11 of the Personal Data Protection Law No. 6698 must be submitted by filling out the form available at www.cagdaskagit.com/kvkk and sent to the company using one of the methods described below in accordance with Article 13 of the Law and Article 5 of the Regulation on the Procedures and Principles of Applying to the Data Controller.

Applications submitted to the company will be answered within 30 days from the date the request reaches the company, depending on the nature of the request, in accordance with Article 13/2 of KVKK. Responses to applications will be delivered to the applicant in written or electronic form in accordance with Article 13 of KVKK.

 

	APPLICATION METHOD	ADDRESS FOR APPLICATION	INFORMATION REQUIRED IN THE APPLICATION
1. Written Application	By personally submitting a wet-signed application or through a notary	Hadımköy Mahallesi İbni Sina Caddesi No:8/5 ARNAVUTKÖY/İSTANBUL	The envelope/notification must be labeled as "Personal Data Protection Law Information Request."
2. Via Registered Electronic Mail (KEP)	Via Registered Electronic Mail (KEP)	[email protected]	The subject of the email must be labeled as "Personal Data Protection Law Information Request."
3. Application via Registered Email Address in the Company System	By using an email address registered in the Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. system	[email protected]	The subject of the email must be labeled as "Personal Data Protection Law Information Request."
4. Application via an Unregistered Email Address	Using an unregistered email address in the Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. system with a mobile or e-signature	[email protected]	The subject of the email must be labeled as "Personal Data Protection Law Information Request."

In case the request is accepted or rejected by providing a justification, the response will be delivered to the applicant electronically or in writing. If the request is accepted, our company will promptly take the necessary action.

REGULATION ON THE PROCEDURES AND PRINCIPLES OF APPLYING TO THE DATA CONTROLLER, ARTICLE 7

FEE: If the application is answered in writing, there will be no charge for up to 10 pages, but a processing fee of 1 Turkish Lira will be charged for each page above 10. If the response to the application is provided on a CD, flash drive, or similar recording medium, a fee equal to the cost of the recording medium will be charged.