UMUR KIRTASİYE SANAYİ A.Ş.
6698 SAYILI KİŞİSEL VERİLERİN KORUNMASI KANUNU KAPSAMINDA AYDINLATMA METNİ
EMPLOYEE PRIVACY NOTICE
1. DATA CONTROLLER AND PURPOSE
This Employee Personal Data Processing and Protection Notice ("Notice") has been prepared in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") in order to fulfil the obligation to inform data subjects.
Your personal data may be processed by Umur Basım Sanayi ve Ticaret Anonim Şirketi (the "Company"), acting in its capacity as the Data Controller, in compliance with the KVKK and the applicable legislation. Such processing shall be carried out lawfully and in good faith, ensuring that the personal data is accurate and, where necessary, kept up to date; processed for specified, explicit and legitimate purposes; and limited to, proportionate with, and relevant for the purposes for which it is processed.
2. CATEGORIES OF PERSONAL DATA AND PURPOSES OF PROCESSING
Identity Information
Data Processed: Full name, Turkish Identification Number, date of birth, place of birth, nationality.
Purposes of Processing: Establishment and performance of the employment relationship, creation and maintenance of personnel files, fulfilment of legal obligations, management of human resources processes, employee performance management, and planning and delivery of training activities.
Contact Information
Data Processed: Telephone number, residential address, e-mail address, emergency contact details.
Purposes of Processing: Communication with employees, emergency management, and administration of human resources processes.
Personnel Records
Data Processed: Personnel registration records, leave records, employment commencement and termination records, disciplinary records.
Purposes of Processing: Administration of the employment relationship, management of human resources processes, and fulfilment of legal obligations.
Professional Experience and Educational Information
Data Processed: Diplomas, certificates, educational records, curriculum vitae (CV), professional qualifications.
Purposes of Processing: Employee assignment, career planning, training administration, and performance management.
Financial Information
Data Processed: Bank account details (IBAN), salary information, payroll records, enforcement and alimony deductions.
Purposes of Processing: Salary payments, payroll administration, accounting processes, and fulfilment of financial and legal obligations.
Employee Benefits and Social Benefits Information
Data Processed: Meal card information, transportation (shuttle) service records, private health insurance information, private pension scheme (BES) information (where applicable).
Purposes of Processing: Administration and provision of employee benefits.
Physical Premises Security and Time Attendance Records
Data Processed: Entry and exit records, access card records, attendance records, CCTV recordings.
Purposes of Processing: Ensuring physical premises security, monitoring working hours, attendance and overtime calculations, and management of occupational health and safety processes.
Information Technologies and System Records
Data Processed: Corporate e-mail usage, system access logs, user account information.
Purposes of Processing: Ensuring information security, administration of business operations, compliance with audit requirements, and fulfilment of record-keeping obligations.
Visual and Audio Data
Data Processed: CCTV recordings, photographs taken during corporate events.
Purposes of Processing: Maintaining security procedures and organising corporate activities and events.
Health Data (Special Categories of Personal Data)
Data Processed: Medical reports, incapacity for work reports, disability information (where applicable), blood group information (where legally or operationally required).
Purposes of Processing: Compliance with occupational health and safety obligations, provision of appropriate working conditions, and fulfilment of legal obligations.
3. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, in accordance with Articles 8 and 9 of the KVKK, to the following recipients where necessary for the purposes specified herein:
The Social Security Institution (SGK), Turkish Employment Agency (İŞKUR), Tax authorities, Competent public authorities and governmental institutions, Courts and Enforcement Offices, Banks, Occupational health and safety service providers; Payroll, audit, legal, human resources and information technology service providers, Private health insurance providers (where applicable), Meal card and employee benefits service providers; and The Company's group companies and affiliates such transfers shall be made solely for the purposes of administering the employment relationship, fulfilling legal obligations, managing human resources processes, and conducting the Company's business operations.
4. TRANSFER OF PERSONAL DATA ABROAD
Your personal data may be transferred abroad pursuant to Article 9 of the KVKK where such transfer is necessary due to the use of Microsoft 365 services, cloud computing services, e-mail systems, backup systems, human resources leave management systems (SAP), whose servers are located outside Türkiye, or due to the use of common information systems shared with the Company's group companies.
5. METHOD OF COLLECTION OF PERSONAL DATA AND LEGAL GROUNDS
Your personal data is collected through automated and non-automated means during recruitment processes, through employment agreements, personnel files, electronic systems, e-mail communications, time attendance systems, CCTV systems, and notifications received from public authorities.
Your personal data is processed on the basis of one or more of the following legal grounds under the KVKK:
where processing is necessary for the establishment or performance of an employment contract;
where processing is necessary for the Data Controller to fulfil its legal obligations;
where processing is necessary for the establishment, exercise or protection of a legal claim; and
where processing is necessary for the legitimate interests of the Data Controller, provided that such processing does not infringe the fundamental rights and freedoms of the data subject.
Special categories of personal data shall be processed only under the conditions prescribed by the KVKK and the applicable legislation.
6. RETENTION PERIOD
Your personal data shall be retained for the retention periods prescribed under the applicable legislation and for as long as necessary to fulfil the purposes for which it has been processed.
Upon expiry of the applicable retention period or where the purposes of processing cease to exist, your personal data shall be erased, destroyed or anonymised in accordance with the KVKK and the relevant legislation.
7. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 11 of the KVKK, you have the right to: learn whether your personal data is being processed; request information regarding the processing of your personal data; learn the purposes of processing and whether your personal data is used in accordance with such purposes; learn the third parties to whom your personal data has been transferred domestically or abroad; request the rectification of incomplete or inaccurate personal data; request the erasure or destruction of your personal data under the conditions stipulated by the KVKK; object to any outcome arising against you through the exclusive analysis of your personal data by automated means; and claim compensation for damages incurred due to the unlawful processing of your personal data.
8. APPLICATION PROCEDURE
You may submit your requests within the scope of the KVKK to the Company in writing, through a notary public, or via registered electronic mail (KEP) to umurbasim@hs01.kep.tr.
Your requests shall be evaluated and concluded within a maximum period of thirty (30) days in accordance with the applicable legislation.
CUSTOMER PRIVACY NOTICE
As Umur Basım Sanayi ve Ticaret A.Ş. (the "Company"), we attach great importance to the protection of individuals' fundamental rights and freedoms. Accordingly, we would like to inform you about the processing of your personal data pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. IDENTITY OF THE DATA CONTROLLER
Umur Basım Sanayi ve Ticaret A.Ş. (the "Company") acts as the Data Controller within the meaning of the KVKK with respect to the personal data collected from its customers.
You may contact us using the contact details below:
Address: Dudullu OSB Mah. 2. Cad. No:5 Ümraniye / Istanbul, Türkiye
Telephone: +90 216 645 62 00
Fax: +90 216 420 04 35
Call Centre: +90 850 201 86 87
Website: www.umurbasim.com
E-mail: musteri@umur.com.tr
2. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING
Within the scope of our customer relationship, the following categories of personal data may be processed:
Identity information; Contact information; Job title, position and employment information; Signature information; Financial and accounting information; Bank account and payment information; Information relating to contracts, quotations, purchase orders, sales and delivery processes; Requests, complaints and customer communications; Visitor records and CCTV recordings collected for physical premises security purposes.
Your personal data is processed for the following purposes:
Managing customer relationships; Managing the sale of products and services; Managing quotation, order, production, shipment and delivery processes; Establishing and performing contractual relationships; Providing after-sales support and ensuring customer satisfaction; Conducting accounting, finance and collection processes; Carrying out corporate communication activities; Conducting audit and reporting activities; Ensuring the security of the Company's physical premises; Fulfilling legal and regulatory obligations; and Establishing, exercising and protecting legal rights in the event of potential disputes.
3. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, in accordance with Articles 8 and 9 of the KVKK, where necessary, to: Competent public authorities and governmental institutions; Courts, Enforcement Offices and other judicial authorities; Banks and financial institutions; Certified public accountants and independent audit service providers; Legal advisers; Information technology and system infrastructure service providers; and Logistics and courier service providers, where required.
Such transfers shall be made solely for the purposes of fulfilling legal obligations, performing contractual obligations, conducting sales, delivery, finance and accounting operations, managing information technology processes, and resolving potential legal disputes.
Except where disclosure is required by applicable law, your personal data shall not be shared with third parties.
4. METHOD OF COLLECTION OF PERSONAL DATA AND LEGAL BASIS FOR PROCESSING
Your personal data may be collected through automated, partially automated or non-automated means via quotation and order forms, contracts, sales records, e-mail correspondence, telephone communications, corporate communication channels, the Company's website, physical and electronic documents, accounting and information systems, and security and access control systems.
Your personal data is processed on the basis of one or more of the following legal grounds under the KVKK: processing is necessary for the establishment or performance of a contract; processing is necessary for the Data Controller to fulfil its legal obligations; processing is necessary for the establishment, exercise or protection of a legal claim; and processing is necessary for the legitimate interests pursued by the Data Controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.
5. RETENTION PERIOD
Your personal data shall be retained for the periods prescribed by the applicable legislation and for as long as necessary to fulfil the purposes for which it is processed.
Personal data processed within the scope of the customer relationship shall, in particular, be retained for the retention periods prescribed under the Turkish Commercial Code, the Tax Procedure Law, the Law on the Protection of Consumers, and other applicable legislation.
Upon expiry of the applicable retention period or where the purposes of processing no longer exist, your personal data shall be erased, destroyed or anonymised in accordance with the KVKK and the applicable legislation.
6. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 11 of the KVKK, you have the right to:
learn whether your personal data is being processed; request information regarding the processing of your personal data; learn the purpose of processing and whether your personal data is used in accordance with such purpose; learn the third parties to whom your personal data has been transferred, whether domestically or abroad; request the rectification of incomplete or inaccurate personal data; request the erasure or destruction of your personal data under the conditions set out in the KVKK; request notification of any rectification, erasure or destruction to third parties to whom your personal data has been transferred; object to any outcome arising against you as a result of the exclusive processing of your personal data through automated means; and claim compensation for damages incurred as a result of the unlawful processing of your personal data.
7. APPLICATION PROCEDURE
You may submit your requests within the scope of the KVKK to the Company in writing, through a notary public, or via registered electronic mail (KEP) to umurbasim@hs01.kep.tr.
Your requests shall be evaluated and concluded within a maximum period of thirty (30) days in accordance with Article 13 of the KVKK.
SUPPLIER PRIVACY NOTICE
As Umur Basım Sanayi ve Ticaret A.Ş. (the "Company"), we attach great importance to the protection of individuals' fundamental rights and freedoms. Accordingly, we would like to inform you about the processing of your personal data pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. IDENTITY OF THE DATA CONTROLLER
Umur Basım Sanayi ve Ticaret A.Ş. (the "Company") acts as the Data Controller within the meaning of the KVKK with respect to the personal data collected from supplier representatives, supplier employees and individual suppliers.
You may contact us using the contact details below:
Address: Dudullu OSB Mah. 2. Cad. No:5 Ümraniye / Istanbul, Türkiye
Telephone: +90 216 645 62 00
Fax: +90 216 420 04 35
Call Centre: +90 850 201 86 87
Website: www.umurbasim.com
E-mail: musteri@umur.com.tr
2. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING
Within the scope of our supplier relationship, the following categories of personal data may be processed:
Identity information; Contact information; Professional experience and employment information; Job title, position and employment information; Signature information; Financial and accounting information; Bank account and payment information; Information relating to contracts, quotations, purchase orders and procurement processes; Requests, complaints and communications records; Visitor records and CCTV recordings collected for physical premises security purposes.
Your personal data is processed for the following purposes:
Managing supplier selection and evaluation processes; Managing the procurement of goods and services; Managing procurement and supply chain operations; Establishing and performing contractual relationships; Conducting accounting, finance and payment processes; Carrying out corporate communication activities; Conducting audit and reporting activities; Ensuring business continuity; Ensuring the security of the Company's physical premises; Managing occupational health and safety processes; Fulfilling legal and regulatory obligations; and Establishing, exercising and protecting legal rights in the event of potential disputes.
3. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, in accordance with Articles 8 and 9 of the KVKK, where necessary, to:
Competent public authorities and governmental institutions; Courts, Enforcement Offices and other judicial authorities; Banks and financial institutions; Certified public accountants and independent audit service providers; Legal advisers; Information technology and system infrastructure service providers.
Such transfers shall be made solely for the purposes of fulfilling legal obligations, performing contractual obligations, conducting finance and accounting operations, managing information technology processes, and resolving potential legal disputes.
Except where disclosure is required by applicable law, your personal data shall not be shared with third parties.
4. METHOD OF COLLECTION OF PERSONAL DATA AND LEGAL BASIS FOR PROCESSING
Your personal data may be collected through automated, partially automated or non-automated means via quotation and supplier application forms, contracts, purchase orders and procurement records, e-mail correspondence, telephone communications, corporate communication channels, physical and electronic documents, ERP, accounting and information systems, and security and access control systems
Your personal data is processed on the basis of one or more of the following legal grounds under the KVKK:
processing is necessary for the establishment or performance of a contract;
processing is necessary for the Data Controller to fulfil its legal obligations;
processing is necessary for the establishment, exercise or protection of a legal claim; and
processing is necessary for the legitimate interests pursued by the Data Controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.
5. RETENTION PERIOD
Your personal data shall be retained for the periods prescribed by the applicable legislation and for as long as necessary to fulfil the purposes for which it is processed.
Personal data processed within the scope of the supplier relationship shall, in particular, be retained for the retention periods prescribed under the Turkish Commercial Code, the Tax Procedure Law, the applicable Occupational Health and Safety legislation, and other applicable legislation.
Upon expiry of the applicable retention period or where the purposes of processing no longer exist, your personal data shall be erased, destroyed or anonymised in accordance with the KVKK and the applicable legislation.
6. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 11 of the KVKK, you have the right to:
learn whether your personal data is being processed; request information regarding the processing of your personal data; learn the purpose of processing and whether your personal data is used in accordance with such purpose; learn the third parties to whom your personal data has been transferred, whether domestically or abroad; request the rectification of incomplete or inaccurate personal data; request the erasure or destruction of your personal data under the conditions set out in the KVKK; request notification of any rectification, erasure or destruction to third parties to whom your personal data has been transferred; object to any outcome arising against you as a result of the exclusive processing of your personal data through automated means; and claim compensation for damages incurred as a result of the unlawful processing of your personal data.
7. APPLICATION PROCEDURE
You may submit your requests within the scope of the KVKK to the Company in writing, through a notary public, or via registered electronic mail (KEP) to umurbasim@hs01.kep.tr.
Your requests shall be evaluated and concluded within a maximum period of thirty (30) days in accordance with Article 13 of the KVKK.
VISITOR PRIVACY NOTICE
As Umur Basım Sanayi ve Ticaret A.Ş. (the "Company"), we attach great importance to the protection of individuals' fundamental rights and freedoms. Accordingly, we would like to inform you about the processing of your personal data pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. IDENTITY OF THE DATA CONTROLLER
Umur Basım Sanayi ve Ticaret A.Ş. (the "Company") acts as the Data Controller within the meaning of the KVKK with respect to the personal data collected from visitors.
You may contact us using the contact details below:
Address: Dudullu OSB Mah. 2. Cad. No:5 Ümraniye / Istanbul, Türkiye
Telephone: +90 216 645 62 00
Fax: +90 216 420 04 35
Call Centre: +90 850 201 86 87
Website: www.umurbasim.com
E-mail: musteri@umur.com.tr
2. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING
During your visit to the Company's premises, the following categories of personal data may be processed:
Identity information; Contact information; CCTV recordings; Visitor entry and exit records; Time and attendance system (PDKS) and access card records.
Your personal data is processed for the following purposes:
Ensuring the security of the Company's physical premises; Managing and monitoring visitor entry and exit procedures; Maintaining the security of the Company's premises; Managing occupational health and safety processes; and Fulfilling legal and regulatory obligations.
3. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, in accordance with Articles 8 and 9 of the KVKK, where necessary, to:
Competent public authorities and governmental institutions; Courts, Enforcement Offices and other judicial authorities; Law enforcement authorities; Security service providers; and Information technology and system infrastructure service providers.
Such transfers shall be made solely for the purposes of fulfilling legal obligations, conducting security operations, and resolving potential legal disputes.
Except where disclosure is required by applicable law, your personal data shall not be shared with third parties.
4. METHOD OF COLLECTION OF PERSONAL DATA AND LEGAL BASIS FOR PROCESSING
Your personal data may be collected through automated or partially automated means via visitor registration forms, security checkpoints, time and attendance (PDKS) and access control systems, and CCTV systems.
Your personal data is processed on the basis of one or more of the following legal grounds under the KVKK:
processing is necessary for the Data Controller to fulfil its legal obligations;
processing is necessary for the establishment, exercise or protection of a legal claim; and
processing is necessary for the legitimate interests pursued by the Data Controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.
5. RETENTION PERIOD
Your personal data shall be retained for the periods prescribed by the applicable legislation and for as long as necessary to fulfil the purposes for which it is processed.
Upon expiry of the applicable retention period or where the purposes of processing no longer exist, your personal data shall be erased, destroyed or anonymised in accordance with the KVKK and the applicable legislation.
6. RIGHTS OF THE DATA SUBJECT
Pursuant to Article 11 of the KVKK, you have the right to:
learn whether your personal data is being processed; request information regarding the processing of your personal data; learn the purpose of processing and whether your personal data is used in accordance with such purpose; learn the third parties to whom your personal data has been transferred, whether domestically or abroad; request the rectification of incomplete or inaccurate personal data; request the erasure or destruction of your personal data under the conditions set out in the KVKK; request notification of any rectification, erasure or destruction to third parties to whom your personal data has been transferred; object to any outcome arising against you as a result of the exclusive processing of your personal data through automated means; and claim compensation for damages incurred as a result of the unlawful processing of your personal data.
7. APPLICATION PROCEDURE
You may submit your requests within the scope of the KVKK to the Company in writing, through a notary public, or via registered electronic mail (KEP) to umurbasim@hs01.kep.tr.
Your requests shall be evaluated and concluded within a maximum period of thirty (30) days in accordance with Article 13 of the KVKK.