Personal Data Protection (KVKK)
This policy on the processing and protection of personal data (the “Policy”) sets out the principles adopted by our company, which operates in the field of corporate network management, to ensure compliance with the legislation in force on the processing of personal data and on the protection and destruction of such data.
Capitalised terms used in this Policy that are not defined in the Policy have the meanings given to them below.
The Company undertakes to comply with the confidentiality and security requirements for Personal Data under the Law, and has therefore adopted this Policy to establish the basis of its understanding, policies and procedures on the protection and processing of Personal Data.
This Policy applies to the Company, to all full-time and part-time employees who have access to Personal Data collected and processed by the Company, who provide information to the Company or who receive Personal Data from the Company, to employees of the Company’s Affiliates, to employees of joint ventures and to all suppliers and vendors. In addition, all provisions of this Policy are subject to the Law and to the Secondary Legislation. Where the provisions of this Policy conflict with the provisions of the Law, the provisions of the Law prevail and apply.
Accordingly, the data subjects covered by this Policy are as follows:
The Company acts lawfully and in good faith when processing Personal Data, and processes Personal Data in accordance with the rules introduced by the Law. The Company also follows the regulations on data processing activities introduced by the Secondary Legislation published by the Board from time to time and, where necessary, revises and improves its practices within this legal framework or endeavours to do so.
The Company takes the measures necessary to ensure that the Personal Data it processes is accurate and, where necessary, up to date.
The Company determines the purpose of data processing clearly and precisely and processes Personal Data only for legitimate purposes. This means that the data processed by the Company is connected with, and necessary for, the business it carries on or the service it provides.
The Company clearly informs Data Subjects of these purposes before obtaining their Personal Data.
If the Company’s purposes for processing Personal Data change, this Policy will be updated to the extent necessary. Efforts will also be made, as far as possible, to announce changes in processing purposes to Data Subjects through different channels.
The Company keeps Personal Data only for the period set out in the relevant legislation or needed for the purpose for which it is processed. Accordingly, where the relevant legislation sets a period for keeping Personal Data, the Company keeps the Personal Data only for that period.
However, since Personal Data may need to be kept under various other legislation, and taking into account in particular the limitation periods for legal actions, the Company applies the maximum retention periods it has set so that its employees and clients do not suffer any loss of rights. Where the legislation sets no period, or there is no legal reason to keep the data longer, the Company keeps Personal Data for the maximum period it has determined to be necessary for the purpose for which it is processed.
In addition, the Company complies with the rules and procedures on the retention of data set out in its Destruction Policy.
The Company processes Personal Data on the basis of one or more of the conditions for lawful processing set out in the Law, and in accordance with the provisions of the Law.
Accordingly:
4.3.1.1 Personal Data may be processed with the Explicit Consent of the Data Subject.
4.3.1.2 Personal Data may also be processed without the Explicit Consent of the Data Subject where one of the following conditions exists:
Under the Company’s compliance programme, it has been decided that the Company’s personal data processing activities will be carried out and supervised by the Data Protection Committee, and they are managed by the Data Protection Committee.
The duties of the Data Protection Committee are as follows:
The Company processes Personal Data in accordance with the conditions set out in the Law. In addition, the Board may introduce special measures for processing Special Categories of Personal Data. If the Board introduces such measures at any time after the publication of this Policy, the Company will make the arrangements needed to comply with them.
Accordingly:
4.3.3.1 Special Categories of Personal Data may be processed with the Explicit Consent of the Data Subject.
4.3.3.2 Special Categories of Personal Data of the Data Subject other than health and sexual life (data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data) may be processed without the person’s Explicit Consent in the cases provided for by law.
4.3.3.3 Personal Data relating to health and sexual life may be processed without the person’s Explicit Consent only by persons under a duty of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.
4.3.3.4 In particular, Personal Data relating directly or indirectly to employees’ health may be processed in order to carry out processes within the employer-employee relationship (leave, salary advances, insurance processes, creating the personnel file, etc.). In such cases, Explicit Consent is obtained from employees, and health data may be processed only by, and is accessible only to, the persons or departments who need to process it. Where the legislation in force and Authority/Board decisions identify cases that do not require consent, this personal data may be processed without explicit consent.
4.3.3.5 Where processing Special Categories of Personal Data is not necessary but such data is closely tied to personal data that must be processed (such as the special categories of personal data shown on an identity card), the special categories of personal data are separated from the personal data to be processed using de-linking methods such as masking.
4.3.3.5 During the Company’s recorded telephone calls, as soon as it becomes clear that the other party has shared special category personal data, that person is immediately told that the data they have shared is special category personal data and is asked whether they consent to its being recorded. If the person does not consent, the call is not recorded; if it has already been recorded, the recording is deleted or masked.
4.4.1 To be valid, consent must be informed, explicit and given freely.
4.4.2.1 The Data Subject must be informed clearly and understandably about all matters relating to the processing. This information must be understandable in language that an average person can follow and must be easily accessible.
4.4.2.2 Explicit Consent should be understood as a statement of approval that is clear enough to leave no room for doubt and is limited to that particular processing. Open-ended consent cannot be accepted as Explicit Consent. As a rule, it is sufficient for the Data Controller to obtain the Data Subject’s Explicit Consent once for the different processing operations it will carry out. However, if it later wishes to process the data for purposes other than its original purpose, separate consent will be required.
4.4.2.3 Explicit Consent must be given freely, without any pressure, and is valid only where the Data Subject is able to make a genuine choice.
4.4.2.4 As long as these conditions are met, the way in which consent is obtained may be chosen freely. It may take the form of clauses in employment contracts, tick boxes on application or purchase forms, or boxes on online forms where Personal Data is entered.
4.4.3 Where consent is obtained together with other written statements, the request for consent must be made prominently.
4.4.4. Consent may be withdrawn by the Data Subject at any time.
4.4.5. The Data Protection Committee, together with the relevant departments, will set up systems to obtain and document the Data Subject’s Explicit Consent to the processing of Personal Data.
4.5.1.1 Personal Data must not be transferred to another organisation, country or region without reasonable and appropriate measures being taken for the required level of data protection.
4.5.1.2 Personal Data may be transferred to third parties only for reasons consistent with the purposes for which it was obtained, or for other purposes permitted by the Law.
4.5.1.3 The necessary security measures must be taken for all Special Categories of Personal Data transferred by the Company, or, as far as possible, such data must be protected against unauthorised access by encryption.
4.5.1.4 Transfers of Personal Data to third parties for subsequent processing activities will be subject to written agreements. The Company, together with the Data Protection Committee, will develop standard terms and conditions that can be used for this purpose.
4.5.1.5 Personal Data may be transferred where any of the following applies:
Our Company may transfer the Personal Data it processes [having taken adequate measures] to third parties established abroad, subject to the conditions set out in 4.4.1 above. However, in accordance with the Law, and except where the Data Subject has given Explicit Consent to the transfer, Personal Data is transferred only to foreign countries declared by the Board to have adequate protection (“Foreign Country with Adequate Protection”), or, where adequate protection does not exist, to foreign countries where the Data Controllers in Turkey and in the relevant foreign country have undertaken adequate protection in writing and the Board has given its permission (“Foreign Country with a Data Controller Undertaking Adequate Protection”).
Transfers abroad include cases where the servers of the programs and applications we use for CRM, bulk e-mail, e-mail and backup, and for other services the Company may need to carry on its activities (Emarsys, Google Adwords, Google Analytics, Facebook, Insider, etc.), or the servers to which the data they obtain is sent, are located abroad.
To ensure security, the Company carries out CCTV monitoring at its premises and processes personal data to track the entry and exit of persons such as employees and visitors.
Personal data is processed through the use of cameras and the recording of employee and visitor entries, exits and activities, in accordance with the Law and other relevant legislation.
Monitoring by CCTV cameras may be carried out primarily to ensure the security of the Company, its visitors and other persons. The Company duly explains to the persons concerned the purposes it has determined in this respect. In addition to its general information notices, the Company also gives notice of CCTV monitoring by other methods it considers appropriate.
Personal data processed through CCTV monitoring is kept for a maximum of [30 days].
In addition, for security purposes, identity checks are carried out and a visitor log is kept by the management of the Kutay Business Centre at entrances to the company’s head office. The necessary measures are taken for the processing and security of personal data in this context.
Data subjects who visit the company’s premises as guests are informed through notices posted at the Company or otherwise made available to guests. Personal data obtained to track guest entries and exits is processed only for this purpose and is recorded in a physical filing system.
The Company informs Data Subjects in accordance with Article 10 of the Law.
In addition to its general information notices, the Company may give notice of camera monitoring by more than one method. The Company aims to prevent harm to the fundamental rights and freedoms of data subjects and to ensure transparency and that data subjects are informed.
For camera monitoring, the Company posts notices at the entrances to monitored areas stating that monitoring takes place. As a rule, only a limited number of Company employees have access to camera recordings. Access authorisation is granted by the Data Protection Committee, and those with access to the recordings also sign a confidentiality undertaking.
The Company may provide internet access to visitors who request it while they are on the Company’s premises. In this case, log records of internet access are kept in accordance with the mandatory provisions of Law No. 5651 and the legislation issued under it; these records may be processed only when requested by authorised public institutions and organisations or to fulfil the relevant legal obligations during internal audit processes.
Only a limited number of Company employees have access to the log records obtained in this way. Company employees with access to these records access them only for use in requests from authorised public institutions or in audit processes, and share them only with legally authorised persons. Access authorisation is granted by the Data Protection Committee, and those with access to the records also sign a confidentiality undertaking.
On the Company’s website, internet activity within the site may be recorded by technical means (e.g. cookies) to ensure that visitors can use the site in line with the purpose of their visit, to show them personalised content and to carry out online advertising.
If the Company carries out such processing, detailed explanations of the protection and processing of personal data in this context are given in the “Cookie Policy” on the Company’s website.
4.7.1 Whenever consent to process Personal Data is requested from the Data Subject, and whenever Personal Data is obtained (whether or not consent is requested), the Data Subject must be properly informed. In this context, the following, including but not limited to:
will be disclosed to the Data Subject.
4.7.2 The above information obligations will not apply where the laws in force provide exceptions to the obligation to inform.
4.7.3 Information should be given as soon as possible, preferably at the first contact with the Data Subject. In the case of employees, information should be given separately. In addition, appropriate explanations should be included in job application forms, employee handbooks and workplace regulations. Explanations should be designed and presented so that they attract the attention of the persons concerned.
4.7.4 Information may be given orally, electronically, or orally or in writing. Where information is given orally, the person giving it must use an appropriate written text or form approved in advance by the Company or the Data Protection Committee. The acknowledgement or form must be kept together with a contemporaneous record identifying the method, content, date and occasion of the explanation.
4.7.5 If the initial explanation is insufficient, additional explanations may be given later, and the occasion, date, content and method of these additional explanations are recorded.
If the Company carries out such processing, detailed explanations of the protection and processing of personal data in this context are given in the “Cookie Policy” on the Company’s website.
As a rule, the Company will not carry out new or extended activities to obtain or process Personal and/or Special Categories of Personal Data without the approval of the Data Protection Committee. All relevant departments and their managers will endeavour to work in harmony with the Data Protection Committee and other departments and will avoid new activities that do not comply with the Law.
4.9.1 Through the Data Protection Committee, the Company will set up a system consistent with its own policies and practices to enable and facilitate the exercise by Data Subjects of their rights listed in Article 11 of the Law, and to inform the persons concerned in the event of improper disclosure of Personal Data.
4.9.2 By a request made in accordance with the policies and procedures set by the Company and the Data Protection Committee, the Data Subject has the right, regarding their own Personal Data:
4.9.2.1 to learn whether the Company processes Personal Data about the Data Subject and, if so, to request information about it,
4.9.2.2 to learn the purpose of processing the Personal Data and whether it is used in line with that purpose,
4.9.2.3 to learn whether the Personal Data has been transferred in Turkey or abroad and to whom.
4.9.3 The Data Subject also has the right to ask the Company to correct inaccurate or incomplete Personal Data and to inform the recipients to whom the data has been or may have been transferred.
4.9.4 Under Article 7 of the Law, the Data Subject may ask the Company to delete and destroy their data if the reasons requiring the processing of their Personal Data no longer exist.
4.9.5 The Data Subject may object to the results of analyses of Personal Data produced exclusively by automated systems if those results are against their interests.
4.9.6 All requests to the Company by the Data Subject to exercise the above rights must be made in writing by completing the request form provided at www.altisdanismanlik.com.tr. Applications may be submitted in person, through a notary public, or by e-mail with a secure electronic signature.
For requests made on behalf of a Data Subject to be processed, the persons acting for the Data Subject must submit to the Company, with their request, a power of attorney (certified by a notary) issued by the Data Subject and containing a specific provision on requests or actions concerning their Personal Data. Those applying on behalf of their children or persons under their guardianship are asked for an identity card and the guardianship decision.
4.9.7. All business units that receive a request from a Data Subject for access to Personal Data will notify the Data Protection Committee of the request.
4.9.8 The Company will set up a system to record such requests when they are received and to record the dates on which they are answered.
Unless the laws and regulations in force require otherwise, the Company will respond to an information request made as described above within 30 days from the date it receives the written request from the Data Subject and from appropriate confirmation of the identity of the requester as the Data Subject or an authorised legal representative. Incomplete, unclear or illegible requests will not be considered by the Company. In such a case, the Company will inform the applicant within 30 days that the application has not been processed.
4.9.9 Even if the Company cannot fully answer the request within the specified period, the Data Protection Department must in any case provide the Data Subject with the following information within the 30-day period:
4.9.10 If providing information to the requesting Data Subject would disclose another person’s Personal Data or risk violating their fundamental rights and freedoms, the business unit handling the request must review the data and make such corrections to the data as may be necessary or appropriate to protect that person’s rights, or must not disclose the data.
4.9.11 The Company will not charge employees any fee for providing the above information. Where an information request imposes additional costs on the Company, the Company may charge the fee in the tariff set by the Board to respond to requests from Data Subjects who are not its employees. In that case, the fees charged cannot exceed the fees announced by the Board from time to time.
4.9.12 The Company and the Data Protection Committee may establish procedures to monitor and refuse repeated or unreasonably burdensome requests made by or on behalf of a Data Subject.
The procedures and principles for retaining and destroying Personal Data, together with the retention periods for personal data, are set out in the Company’s Retention and Destruction Policy.
The Company keeps the Personal Data it processes in accordance with the principles of the Law for the period set out in the legislation. Where the legislation sets no specific period for keeping the relevant categories of Personal Data, the Personal Data is kept until the purpose for which it is processed ends.
Where the legislation sets no specific period for keeping the relevant categories of Personal Data, retention periods are set separately for each processing purpose, taking into account the Company’s practices and the customs of commercial life.
Personal Data may be kept beyond the processing purpose to serve as evidence in possible legal disputes, to assert a right that can be proven with the Personal Data, to establish a defence, and to answer information requests from authorised public bodies. In setting these periods, the limitation periods for asserting the right in question, retention obligations arising from the legislation applicable to the Company’s activities, the contracts to which it is a party and the international regulations to which it is subject are taken into account.
When these periods expire, the Company takes the steps needed to destroy the relevant Personal Data in a reasonably possible and appropriate manner. The Company may also delete, destroy or anonymise Personal Data on its own initiative or, as the case may be, at the request of the Data Subject. Through the Data Protection Committee, the Company decides which of these methods is reasonable and applies that method. The Data Subject may request information on why the Company chose this method by exercising their rights described in section 4.9.
In accordance with Article 28 of the Law, Anonymised Personal Data may be processed for purposes such as research, planning and statistics.
In applying this Policy, the Company will observe the principle of proportionality. Care will be taken that the cost and effort spent on the Company’s data processing activities and on protecting the relevant Personal Data are proportionate to the purpose of protecting the data.
Where mandatory, the Company will fulfil its registration obligation under the Regulation on the Data Controllers Registry.
Where the Company receives services or other support from others to assist its processing activities, a Data Processor will be selected that provides adequate security measures and takes reasonable steps to comply with them, in accordance with the Law, the Secondary Legislation and Company policies.
The Company will enter into a written contract with each Data Processor requiring it to comply with the data confidentiality and security requirements that the Company must meet under the Law and the Secondary Legislation.
As part of the Company’s internal data audit processes, the Company will from time to time audit the data processing activities carried out by third-party Data Processors, in particular data security and measures, and will put in place the legal framework needed to carry out these audits.
7.1.1 To ensure the security of Personal Data, including against alteration, loss, damage and unauthorised processing or access, the Company will take physical, technical or organisational measures, taking into account the state of technological development, the nature of the data and the risks to which it is exposed from human action or the physical or natural environment.
7.1.2 The security measures to be taken will be determined and implemented in accordance with the company’s information security policies.
7.1.3 Measures are taken to ensure that software developed by the Company does not breach the conditions for processing personal data detailed in 4.3.1 and that the personal data it holds is kept securely.
7.1.4 The Company takes additional security measures to protect special categories of personal data and to ensure that personal data is processed in line with the conditions detailed in 4.3.1.
As part of the Company’s internal data audit processes, the Company will from time to time audit the data processing activities carried out by third-party Data Processors, in particular data security and measures, and will put in place the legal framework needed to carry out these audits.
Everyone involved in any stage of the processing of Personal Data must expressly give a confidentiality undertaking, which must continue after the end of the employment relationship, and sign a confidentiality agreement.
8.1.1 Employees with complaints or questions about the processing of their own Personal Data should first discuss the matter with the Data Protection Committee. Where the Data Subject does not wish to raise a question or complaint with the Data Protection Committee, or where the Data Protection Committee cannot find a satisfactory solution to the Data Subject’s questions or requests within 30 days of the request, the employee should raise the matter in writing with the Data Protection Department at the end of that period.
8.1.2 Where the issue cannot be resolved through the Data Protection Committee, disputes should be resolved in accordance with the company’s internal regulations and the provisions of the employment contract.
Everyone involved in any stage of the processing of Personal Data must expressly give a confidentiality undertaking, which must continue after the end of the employment relationship, and sign a confidentiality agreement.
Through the Data Protection Committee, the Company should set a programme and carry out data protection compliance audits for all business units. In coordination with the business units, the Company should produce a plan and programme to correct the deficiencies identified within a reasonable period.
Each business unit should assess its data collection, processing and security practices. This annual assessment should cover at least the following:
9.2.1 Departments will establish which Personal Data is collected or planned to be collected by the department, the purpose of collecting and processing the data, any additional permitted purposes, the main use of the data, whether the person concerned has consented to this processing and the scope of that consent, all legal obligations relating to collecting and processing the data, and the scope, adequacy and implementation of security measures.
9.2.2 Departments will establish whether any Personal Data is processed by non-automated means as part of a data filing system.
9.2.3 Departments should identify the persons to whom Personal Data under their control has been transferred. The department should determine where those persons are located, the purposes of the transfer and which physical and technical systems and processes are in place to at least maintain the existing level of data security.
9.2.4. The information obtained from this annual assessment should be reported to the Data Protection Committee so that appropriate measures can be taken, company policies and procedures updated and appropriate processes put in place.
Through the Data Protection Committee, the Company should set a programme and carry out data protection compliance audits for all business units. In coordination with the business units, the Company should produce a plan and programme to correct the deficiencies identified within a reasonable period.
This policy will be made available to employees by the Human Resources Department.
This Policy enters into force on publication. All departments will work together to develop a timetable and process for implementing this policy. This implementation process will include resolving conflicts between this Policy and other existing policies.
This Policy may be amended at any time. Notice of material changes will be given to employees by the Company’s Human Resources Department and to others through an appropriate mechanism chosen by the Data Protection Committee.
The Data Protection Committee is responsible for maintaining this Policy. Each department manager is responsible for applying this Policy. Questions about the application of this Policy should be directed to the Data Protection Committee.
Each section of this policy will be interpreted so as to uphold that section under the applicable law; however, if any provision is prohibited or held invalid, the invalidity of that provision will apply only to the extent of that prohibition or invalidity, without affecting the remainder of the provision or the other provisions of this Policy.
As data controller, Altis Danışmanlık (“Altis Danışmanlık”) would like to inform you, under Article 10 (“Data Controller’s Obligation to Inform”) of the Personal Data Protection Law No. 6698 (“KVKK”), published in the Official Gazette No. 29677 of 7 April 2016 to protect the fundamental rights and freedoms of individuals, in particular the privacy of private life, in the processing of personal data and to set out the obligations of natural and legal persons who process personal data.
Altis Danışmanlık keeps its system infrastructure and internet servers at the most reliable level to protect the confidentiality of the personal information it receives from clients and/or client representatives.
Each section of this policy will be interpreted so as to uphold that section under the applicable law; however, if any provision is prohibited or held invalid, the invalidity of that provision will apply only to the extent of that prohibition or invalidity, without affecting the remainder of the provision or the other provisions of this Policy.
Within the conditions for processing personal data set out in Articles 5 and 6 of the KVKK, Altis Danışmanlık processes your personal data for purposes such as reporting suspicious transactions relating to misuse of information or market fraud as required by the legislation to which we are subject, keeping data accurate and up to date, planning corporate communications, preparing all records and documents underlying transactions, complying with obligations set by legislation and official authorities, providing the products and services requested and performing the contract you have concluded.
Altis Danışmanlık may obtain the personal data of clients and/or client representatives through all written, oral and electronic channels, from third parties and from legal authorities.
The legal grounds for the purposes of processing personal data include: use in all products and services within the obligations arising from the legislation to which our company is subject; recording identity, address and other necessary information to identify the transacting party; preparing all records and documents underlying transactions; complying with the information retention, reporting and notification obligations set by legislation and official authorities; providing the products and services requested; and performing the contract you have concluded.
For the purposes stated above, and to the extent permitted by the legislation and required by our business processes, personal data is shared with the persons and organisations to which it may be or is transferred, with public legal entities, and with third parties, in particular Altis Danışmanlık and its affiliates. In addition, personal data may be shared with public institutions and other organisations as required by legislation or due to a legal obligation, and may be subject to legal reporting. In this context, if a request is received from official authorities, the sharing of your personal data with official authorities such as the Capital Markets Board and the Financial Crimes Investigation Board will be subject to the exception provided for in the Law.
Your personal data may be kept for as long as required by the purposes for which it is processed. Where there is no other reason or legal ground, no international law or regulation applies and the obligations arising from contracts have ended, personal data whose processing purposes no longer exist is deleted, destroyed or anonymised.
You may exercise the following rights concerning the processing of your personal data by submitting a request to Altis Danışmanlık. Requests submitted in this context will be concluded by Altis Danışmanlık free of charge within thirty days at the latest. However, if the Personal Data Protection Board sets a fee, the fee in the tariff determined by our company will be charged. Accordingly, as a data subject you have the right to:
The legal grounds for the purposes of processing personal data include: use in all products and services within the obligations arising from the legislation to which our company is subject; recording identity, address and other necessary information to identify the transacting party; preparing all records and documents underlying transactions; complying with the information retention, reporting and notification obligations set by legislation and official authorities; providing the products and services requested; and performing the contract you have concluded.
Altis Danışmanlık keeps the personal data it processes for the legal period required for the purpose of processing.
Unless specific legal, regulatory or binding requirements provide otherwise, the retention period for records and other documentary evidence arising from the provision of services is a maximum of 10+1 years. These periods are set according to the Altis Danışmanlık Personal Data Retention and Destruction Policy.
1. Providing professional services
Altis Danışmanlık provides a wide range of professional services. Personal data may need to be processed to deliver advisory services and the outputs prepared. For example, payroll data is reviewed as part of the audit process, and personal data is used for international assignment services provided under people management and organisation advisory, and for tax and payroll services.
Legal grounds: performance of a contract, legitimate interests, legal obligation, provision by law, processing being necessary for the establishment, exercise or protection of a right, or explicit consent.
2. Administering, managing and developing our activities and services
Altis Danışmanlık processes personal data to run its business and to carry out the following:
Legal grounds: performance of a contract, fulfilment of a legal obligation, legitimate interests.
3. Security, quality and risk management activities
Altis Danışmanlık has security measures in place to protect its own company and client information (including personal data). These are used to detect, investigate and resolve security threats. Personal data may be processed as part of the security monitoring undertaken, and automated scans may be carried out to detect harmful e-mails. To improve service quality, the services provided to clients are monitored, including the processing of personal data held in the relevant client file. Policies and procedures are in place to manage risks relating to client contracts and to monitor the quality of services. Altis Danışmanlık processes personal data as part of its client contract and acceptance procedures. As part of the procedures applied under anti-money laundering legislation, searches using publicly available sources are carried out to identify high-risk individuals and companies and to determine whether there are circumstances that prevent working with a particular client (sanctions, judicial, official or other known issues concerning company directors, etc.).
Legal grounds: legitimate interest, provision by the relevant laws, legal obligation.
Processing personal data is necessary to ensure network and information security, to manage risks and to control the quality of services, and to protect the legitimate interests of Altis Danışmanlık provided that it does not harm the fundamental rights and freedoms of the data subject; where expressly provided for by the relevant laws; or where data processing is necessary for the establishment, exercise or protection of a right.
4. Providing clients and prospective clients with information about Altis Danışmanlık and its service groups
Unless the client indicates otherwise, Altis Danışmanlık may process client contact details that it considers relevant to itself and its services, taking all necessary technical and administrative measures. Examples include sector updates and insights, other activities relating to events and event invitations, and communications.
Personal data may be processed through other Altis Danışmanlık companies and service providers to provide information about Altis Danışmanlık and its services and to manage the client relationship system, while ensuring the security of your data and taking all necessary measures.
5. Complying with legal regulations and the rules of the professional bodies of which Altis Danışmanlık is a member
Like every professional service provider, Altis Danışmanlık is subject to legal, administrative and professional obligations. Certain records must be kept to ensure that services comply with these obligations, and these records may include personal data.
Legal grounds: legal obligations or legitimate interests.
Personal data may need to be processed to fulfil a legal obligation, for example when carrying out due diligence procedures to comply with anti-money laundering regulations. Where there is no legal obligation, Altis Danışmanlık has legitimate interests in processing personal data in connection with company policy or the fulfilment of professional obligations.
Altis Danışmanlık constantly looks for different ways to develop its activities and services and to support its clients. Where agreed with clients, information obtained while providing services may be processed for other lawful purposes, including analyses aimed at better understanding a particular subject or sector, providing insights to clients, improving our activities and the way we provide services, and developing new Altis Danışmanlık technologies and services. Before using personal information for these purposes, Altis Danışmanlık anonymises the personal data obtained while providing services as far as possible for this purpose.
Legal grounds: legitimate interests.
Altis Danışmanlık has a legitimate interest, provided that it does not harm the fundamental rights and freedoms of the data subject, in processing anonymised data to support clients, improve business activities, service delivery and offers, and develop new Altis Danışmanlık technologies and offers by carrying out benchmarking and analysis.
To exercise your rights regarding your personal data under Law No. 6698, you may deliver a petition containing your request, together with documents proving your identity, in person to Altis Danışmanlık at Rüzgarlı Bahçe Mah. Demir Plaza No:3 K:3, 34805 Kavacık – Beykoz / ISTANBUL, send it through a notary public, send an e-mail to info@altisdanismanlik.com.tr, or send it with a secure electronic signature to our registered e-mail (KEP) address.
Written applications on this subject will be accepted following identity verification by us, and the persons concerned will be answered in writing within the legal deadlines.
The legal grounds for the purposes of processing personal data include: use in all products and services within the obligations arising from the legislation to which our company is subject; recording identity, address and other necessary information to identify the transacting party; preparing all records and documents underlying transactions; complying with the information retention, reporting and notification obligations set by legislation and official authorities; providing the products and services requested; and performing the contract you have concluded.
Altis S.M.M.M Danışmanlık Ltd. Şti.
Tax No: 0660272181
Contact: https://www.altisdanismanlik.com.tr/en/contact/
Address: Rüzgarlı Bahçe Mah. Demir Plaza No:3 K:3 – 34805 Kavacık – Beykoz / ISTANBUL
Altis S.M.M.M Danışmanlık Ltd. Şti. (the “Company”) has prepared this Information Notice to explain which of your personal data we will process and for what purposes. We hereby inform you that in all circumstances we will process the personal data listed below:
and that, under the conditions set out in the KVKK, it may be transferred or assigned to third parties in Turkey or abroad, classified and processed in the other ways listed in the KVKK.
We may process personal data relating to employees that they provide to us. By way of example, the personal data that may be processed is as follows:
Identity data: name, surname, date of birth, country of birth, city of birth, gender, marital status, nationality, Turkish identity card details (Turkish ID number, serial number, card number, father’s name, mother’s name, place of birth, province, district, neighbourhood, volume number, family sequence number, sequence number, household number, page number, registration number, place of issue, reason for issue, date of issue, previous surname), copy of identity card.
Contact data: telephone number, full address, e-mail address, internal company contact details (extension number, corporate e-mail address).
Financial data: financial and salary details, payrolls, bonus entitlements, bonus amounts, file and debt information relating to enforcement proceedings, bank account book, minimum living allowance information, private health insurance amount.
Special categories of personal data: criminal record, disability status/description/percentage, religion, health data, blood type, private health insurance policy, health reports, pre-employment health report, chest X-ray, hearing test, eye test, pre-employment and periodic examination forms signed by the workplace physician, pregnancy status, pregnancy report, sick leave and maternity leave information, association/foundation memberships.
Education data: education level, certificate and diploma details, foreign language skills, training and skills, CV, courses attended.
Visual and audio data: photographs of the person, voice recordings, camera recordings.
Employee performance and career development data: training and skills, information on which training was taken on which date, e-mail, signed attendance form, client meeting quality assessment form, monthly performance assessment and target achievement status, activity information.
Family and relatives data: marriage certificate; name, surname, Turkish ID number, gender, date of birth, height, weight, occupation and telephone number of spouse and children; name, surname and telephone number of relatives.
Employment data: employee number, position, department and unit, title, latest start date, start and end dates, insurance start/retirement, pension allocation number, social security number, TTF number, tax office number, flexible working status, travel status, pension fund, pension fund entry date, pension fund registration number, Bağ-Kur entry date, Bağ-Kur registration number, accounting code, number of working days, projects worked on, total monthly overtime, severance base date, additional severance days, days spent on strike.
Leave data: leave seniority base date, additional leave seniority days, leave group, departure/return date, number of days, reason for leave, address/telephone while on leave.
Other: military service deferment, vehicle plate number, copy of vehicle registration, vehicle mileage, vehicle location, copy of driving licence, traffic fine enquiry result, private fund name, private fund entry date, private fund registration number, shoe size, clothing size, height, weight, status as a relative of a martyr, intern status, employee internet access logs, entry and exit logs.
To fulfil our legal obligations as an employer, to perform the employment contract between us, for reasons provided for by law and in the legitimate interest of the Company, we collect your personal data that we request directly from you, that we requested in advance through our platform or other recruitment platforms during your job application, or that is contained in the CV or other texts you chose to share with us during your application, when you send it to us physically or electronically and when you save information to Company computer programs, applications and servers used by more than one person or to the internet where it is accessible to third parties.
Under the Company’s legal obligation and legitimate interest in ensuring workplace security, we collect it through cameras installed in the workplace building.
Under the Company’s legitimate interest in training employees to provide effective client support, we collect your voice recordings through the voice recording program we use.
To fulfil our legal obligation and because it is provided for by law, we collect your health data physically through our workplace physician, and, to ensure workplace security, we collect your personal data physically or electronically from the building management.
To fulfil our legal obligations, we collect it through legal documents and notifications sent to us.
Under the Company’s legitimate interest in developing its platform and making it more effective, we collect your personal data through the cookies used on our website, as detailed in our Cookie Policy.
Your personal data may be processed by the Company for purposes and legal reasons such as, but not limited to, those set out below.
To fulfil the purposes necessary for the performance of the employment contract, in particular:
To meet the requirements of the Labour Law, the Occupational Health and Safety Law, the Social Security Law and related legislation, and other laws and legislation, in particular:
To ensure security within the Company, in particular:
Because of requirements arising from the performance of client contracts, in particular:
For the administration of the Company, the conduct of business and the application of company policies, in particular:
Your personal data will be kept for the maximum period set out in the relevant legislation or needed for the purpose for which it is processed and, in any case, for the statutory limitation periods.
For your safety and so that our Company can fulfil its legal obligations, your personal data may be shared, to the extent permitted and required by the Labour Law, the Occupational Health and Safety Law, the Social Insurance and General Health Insurance Law, the Law on the Regulation of Internet Publications and Combating Crimes Committed Through Such Publications, the Turkish Commercial Code, the Personal Data Protection Law No. 6698, the Identity Notification Law and other legislation, including but not limited to these, with the relevant institutions or organisations, namely public legal entities such as the Personal Data Protection Authority, the Ministry of Finance, the Ministry of Customs and Trade, the Ministry of Labour and Social Security, the Turkish Employment Agency (İŞKUR) and the Information and Communication Technologies Authority. For example, employees’ personal data is shared with the Social Security Institution so that employee and employer premiums can be paid.
We may also process your personal data as follows:
To fulfil the purposes necessary for the performance of the employment contract, in particular: we may process it in the Luca accounting program to carry out payroll processing and update the relevant data. This data is stored in the application’s own data storage.
To meet the requirements of the Labour Law, the Occupational Health and Safety Law, the Social Security Law and related legislation, and other laws and legislation, in particular: we may transfer payroll information to the Company’s auditors so that they can carry out their audit work.
To ensure security within the Company, in particular: we may transfer it to the workplace building management to check entries and exits for workplace security.
To fulfil our legal obligations, in particular: we may share it with our lawyers so that we can exercise our right of defence and, provided it is lawful and procedurally correct, with the relevant institutions within the scope of our obligation to comply with legal requests such as court orders or requests for evidence.
For the administration of the Company, the conduct of business and the application of company policies, in particular:
If you give your consent, your personal data may be shared with third parties abroad to maintain contact during travel and training abroad, to organise travel and to send bulk e-mails.
Under Article 11 of the KVKK, by applying to us in person and proving your identity, you have the right to learn whether the Company processes personal data about you and, if so, to request information about it; to learn the purpose of processing your personal data and whether it is used in line with that purpose; and to learn whether your personal data has been transferred in Turkey or abroad and to whom.
You also have the right to ask the Company to correct inaccurate or incomplete personal data and to inform the recipients to whom the data has been or may have been transferred.
You may ask the Company to destroy (delete, destroy or anonymise) your personal data under the conditions set out in Article 7 of the KVKK. You may also ask that the third parties to whom the data has been or may be transferred be informed of your destruction request. However, we will assess your destruction request and decide which method is appropriate according to the circumstances of the case. You can always ask us why we chose the destruction method we selected.
You may object to the results of an analysis of your personal data produced exclusively by an automated system if those results are against your interests.
If you suffer damage as a result of the unlawful processing of your personal data, you may claim compensation.
Depending on their nature, the requests in your application will be concluded free of charge within thirty days at the latest. However, if the process involves an additional cost for the Company, the fee in the tariff set by the Personal Data Protection Board in the Communiqué on the Procedures and Principles for Applications to the Data Controller may be charged.
You may submit your application on matters relating to the processing of your personal data by completing the application form on the Company’s website or, subject to the conditions in Article 5 of the Communiqué on the Procedures and Principles for Applications to the Data Controller, in the following ways:
Altis S.M.M.M Danışmanlık Ltd. Şti.
Tax No: 0660272181
Contact: https://www.altisdanismanlik.com.tr/en/contact/
Address: Rüzgarlı Bahçe Mah. Demir Plaza No:3 K:3 – 34805 Kavacık – Beykoz / ISTANBUL
As Altis S.M.M.M Danışmanlık Ltd. Şti. (the “Company”), established in Turkey, in our capacity as data controller,
we hereby inform you that your personal data obtained in the ways described below will, within the scope of our commercial relations or our business relationship with you, for the purpose that requires its processing and in a manner connected with, limited to and proportionate to that purpose, keeping the personal data accurate and up to date as notified to us, be recorded, stored, kept, reorganised, shared with institutions legally authorised to request such personal data and, under the conditions set out in the KVKK, transferred or assigned to third parties in Turkey or abroad, classified and processed in the other ways listed in the KVKK.
The personal data provided to us by you or by the authorised persons of the company you represent within the scope of our contractual relationship, which may be processed by us, is as follows:
Identity data: name, surname, Turkish ID number, date of birth, place of birth, gender, marital status, nationality, copy of identity card/driving licence.
Contact data: e-mail address, address and telephone number.
Special categories of personal data: religion and blood type shown on the copy of the identity card/driving licence, criminal record.
Financial data: bank account details.
Education data: trainers’ CVs.
Employment data: SGK hiring notification and assignment documents, start date, title, signature circular.
Visual and audio data: photographs of the person, security camera recordings.
Vehicle plate number.
To fulfil our legal obligations as a Company, to perform the contract between us and your company and/or you, for reasons provided for by law and in the legitimate interest of the Company, we collect your personal data that we request from you and/or from other representatives/employees acting for your company, physically or electronically, when it is sent to us orally, physically or electronically by you and/or other representatives/employees of your company, and through the cameras installed in Company buildings.
Your personal data may be processed by the Company for the purposes and legal reasons set out below.
To apply the contracts between us and fulfil their terms and conditions:
It may be processed where necessary to apply our Company policies.
It may be processed so that we can exercise our right of defence or, where requested of us within a proper legal process, to fulfil our legal obligation.
It may be processed to fulfil legal obligations such as ensuring and supervising occupational health and safety at the Company’s workplace and building.
Your personal data will be kept for the maximum period set out in the relevant legislation or needed for the purpose for which it is processed and, in any case, for the statutory limitation periods.
From time to time and to the extent required by the activity, your personal data may be shared, in order to carry on our Company’s operations, with third parties such as the company managing the building in Turkey, the professional advisers, accountants and auditors from whom the Company receives services, companies providing information technology and archiving services, the occupational health and safety institutions and experts from whom we receive services to fulfil our legal obligations, institutions with which the Company has a commercial, administrative or contractual relationship, banks, and, for our internal operations, the Company’s controlling shareholder and its group companies.
Under Article 11 of the KVKK, by applying to us in person and proving your identity, you have the right regarding your personal data to:
You also have the right to ask the Company to correct inaccurate or incomplete Personal Data and to inform the recipients to whom the data has been or may have been transferred.
You may ask the Company to destroy (delete, destroy or anonymise) your personal data under the conditions set out in Article 7 of the KVKK. You may also ask that the third parties to whom the data has been or may be transferred be informed of your destruction request. However, we will assess your destruction request and decide which method is appropriate according to the circumstances of the case. You can always ask us why we chose the destruction method we selected.
You may object to the results of an analysis of your personal data produced exclusively by an automated system if those results are against your interests.
If you suffer damage as a result of the unlawful processing of your personal data, you may claim compensation.
Depending on their nature, the requests in your application will be concluded free of charge within thirty days at the latest. However, if the process involves an additional cost for the Company, the fee in the tariff set by the Personal Data Protection Board in the Communiqué on the Procedures and Principles for Applications to the Data Controller may be charged.
You may submit your application on matters relating to the processing of your personal data by completing the application form on the Company’s website or, subject to the conditions in Article 5 of the Communiqué on the Procedures and Principles for Applications to the Data Controller, in the following ways:
Altis S.M.M.M Danışmanlık Ltd. Şti.
Tax No: 0660272181
Contact: https://www.altisdanismanlik.com.tr/en/contact/
Address: Rüzgarlı Bahçe Mah. Demir Plaza No:3 K:3 – 34805 Kavacık – Beykoz / ISTANBUL
As Altis S.M.M.M Danışmanlık Ltd. Şti. (the “Company” or the “Platform”), in our capacity as data controller, we hereby inform you that your personal data will, for the purpose that requires its processing and in a manner connected with, limited to and proportionate to that purpose, keeping the personal data accurate and up to date as notified to us, be recorded, stored, kept, reorganised, shared with institutions legally authorised to request such personal data, transferred or assigned to third parties in Turkey or abroad, classified and processed in the other ways listed in the Personal Data Protection Law (the “KVKK”).
We also inform you that the personal data listed below that you provide to us, and the personal data we obtain as described below, will in all circumstances, within the scope of our legal relations:
If you are a visitor whose personal data we obtain and process, the personal data we obtain and process is as follows:
When you visit our Company, under the Company’s legal obligation and legitimate interest in ensuring workplace security, we collect your visual data through the cameras installed at the Company and the personal data we request from you when you give it to us orally or physically.
Your personal data lawfully obtained by us is processed by the Company within the scope of the Company’s legitimate interests, without harming your rights, for the following purpose:
Your personal data will be kept for the maximum period set out in the relevant legislation or needed for the purpose for which it is processed and, in any case, for the statutory limitation periods. The retention period may vary according to the categories of personal data and the purposes of processing. You can contact us for detailed information on the retention period and destruction of your personal data.
Your data is not shared with unrelated third parties. Your footage on cameras installed by the workplace building management and the identity information you give to the Kutay Business Centre building management are kept and processed by the workplace building management in its capacity as data controller.
Under Article 11 of the KVKK, by applying to us in person and proving your identity, you may, regarding your personal data:
Depending on their nature, the requests in your application will be concluded free of charge within thirty days at the latest. However, if the process involves an additional cost for the Company, the fee in the tariff set by the Personal Data Protection Board in the Communiqué on the Procedures and Principles for Applications to the Data Controller may be charged.
You may submit your application on matters relating to the processing of your personal data by completing the application form on the Company’s website or, subject to the conditions in Article 5 of the Communiqué on the Procedures and Principles for Applications to the Data Controller, in the following ways:
Altis S.M.M.M Danışmanlık Ltd. Şti.
Tax No: 0660272181
Contact: https://www.altisdanismanlik.com.tr/en/contact/
Address: Rüzgarlı Bahçe Mah. Demir Plaza No:3 K:3 – 34805 Kavacık – Beykoz / ISTANBUL
The legal grounds for the purposes of processing personal data include: use in all products and services within the obligations arising from the legislation to which our company is subject; recording identity, address and other necessary information to identify the transacting party; preparing all records and documents underlying transactions; complying with the information retention, reporting and notification obligations set by legislation and official authorities; providing the products and services requested; and performing the contract you have concluded.
Fill in the form or call us, and we'll get back to you as soon as possible.Let's review your financial processes together