Personal Data Protection and Processing Policy

One policy for all groups of persons.

This policy applies to all personal data we process, including that of our employees, job applicants, interns and vocational trainees, customers, representatives of our suppliers and business partners, visitors and shareholders.

Data controller

Malkan Makina Sanayi ve Ticaret A.Ş.

MERSİS

0611088265100001

Address

Karayolları Mah. 559. Sok. No:16/1 Gaziosmanpaşa / İstanbul

KEP

malkanmakina@hs06.kep.tr

Telephone

+90 212 477 97 97

As much as needed, for as long as needed, with whom it is needed.

• We process personal data lawfully and in good faith.
• We keep it accurate and, where necessary, up to date.
• We process it only for specified, explicit and legitimate purposes.
• We request data that is relevant, limited and proportionate to the purpose.
• We keep it for the period laid down by legislation or required by the purpose, and then destroy it.

Asking for consent is easy; we look for the legal basis first.

We process personal data on the grounds set out in Article 5 of the Law: explicit provision by law, the establishment or performance of a contract, a legal obligation, the establishment and protection of a right, and legitimate interest.

• We request explicit consent only where no other legal ground exists, through a separate statement that can be withdrawn.
• Our privacy notices serve information purposes; they are not tied to any consent or acceptance.

Sensitive data is, by default, never requested.

• We process health data only to the extent required by occupational health and safety legislation, under the responsibility of the workplace physician; our managers learn only the fitness-for-work result.
• We do not request criminal record certificates.
• We do not use biometric systems such as fingerprint or facial recognition; staff entry is by card.
• We do not ask about religion, ethnic origin, political opinion, or membership of associations or trade unions.

Each group has its own notice.

• Website visitors
• Customers, after-sales and trade fairs
• Site visitors and CCTV
• Correspondents on our WhatsApp line
• Job applicants
• Cookies

Our employees, interns and vocational trainees (and their parents or guardians) are additionally informed through a signed notice when they start work or training.

Everyone we entrust with data is bound by the same rule.

• Within Türkiye, we share personal data only with our business partners, service providers and competent public institutions, for the purposes stated in our privacy notices.
• We conclude data processing agreements containing confidentiality, security and end-of-contract destruction clauses with service providers that process data on our behalf.
• For transfers abroad we follow the order set out in Article 9 of the Law: an adequacy decision; failing that, a standard contract and notification to the Authority; failing both, only the exceptions laid down in the Law for incidental cases.

Data whose time has expired leaves without a trace.

• We have set retention periods separately for each process; we delete, destroy or anonymise data whose period has expired in the periodic destruction carried out every six months, and record each destruction in minutes.
• We limit access according to duties, transmit data over encrypted connections and back it up regularly; our employees are bound by a confidentiality undertaking and receive regular training.
• In the event of a data breach, we notify the Personal Data Protection Board within 72 hours at the latest, and the persons concerned as soon as reasonably possible.

Compliance is not done once; it is maintained every day.

You may exercise your rights under Article 11 of the Law in accordance with our application procedure; applications are concluded within 30 days at the latest.

• Work on the protection of personal data is coordinated by our KVKK contact person appointed by our management.
• We review our personal data processing inventory and our policies at least once a year.