Supplier and Business Partner Privacy Notice

The same signature on every link of our supply chain.

Data controller

Malkan Makina Sanayi ve Ticaret A.Ş.

MERSİS

0611088265100001

Address

Karayolları Mah. 559. Sok. No:16/1 Gaziosmanpaşa / İstanbul

KEP

malkanmakina@hs06.kep.tr

Telephone

+90 212 477 97 97

From workbench to shipment, everyone we work with.

This notice covers employees, representatives and agents of our suppliers, subcontractors, service providers, transport companies, and domestic and foreign dealers and distributors; suppliers we work with as sole proprietorships; and prospective suppliers from whom we request quotations.

During a visit to our premises, the Site Visit and CCTV Privacy Notice also applies. Our expectations of suppliers are set out in the Supply Chain and Sustainability Policy (in Turkish).

We ask only for what the cooperation requires.

• Identity: name, surname, job title; for sole proprietorships, the tax or Turkish ID number for invoicing.
• Contact: business telephone, e-mail, company address.
• Supply transactions: quotation, order, contract, delivery, quality and performance evaluation records.
• Finance: for sole proprietorships, bank account and invoice details.
• Professional qualification: only the training and qualification documents required by legislation for contractor employees who will work on our premises.

We do not request health information, criminal records or any other special category of personal data.

Information comes from the documents of the work we do together.

• Quotation, order, contract and invoice documents.
• E-mail, telephone and face-to-face meetings; business cards given at trade fairs.
• Supplier evaluation and quality records.
• Signature circulars and trade registry records shared by your company to verify signing authority.

Every operation has a purpose; every purpose has a legal basis.

• Requesting quotations and selecting suppliersIdentityContactArt. 5/2-cArt. 5/2-f
• Establishing and performing the contract; orders and deliveriesIdentityContactSupply transactionsArt. 5/2-c
• Payment, invoicing, accounting and tax obligationsIdentityFinanceArt. 5/2-ç
• Supplier quality and performance evaluationSupply transactionsArt. 5/2-f
• Occupational health and safety coordination with contractor staff working on our premisesIdentityProfessional qualificationArt. 5/2-ç
• Verifying signing and representation authorityIdentityArt. 5/2-cArt. 5/2-ç
• Protecting rights in legal disputesRelevant dataArt. 5/2-e

We share, but we do not sell.

• Banks (payments).
• The Revenue Administration and our e-invoice service provider (legal obligation).
• Our IT and hosting service providers; they process data only on our instructions and under a contract.
• Quality certification bodies (during audits, to the extent necessary).
• Lawyers, judicial authorities and competent public institutions (legal obligation and protection of rights).

Transfers abroad are made only under the conditions of Article 9 of the Law. Your personal data is never sold or rented under any circumstances.

When the period ends, we destroy it and record every destruction.

• Quotations, orders, contracts and correspondenceFrom the end of the relationship10 years
• Invoices and payment recordsFrom the end of the relevant year10 years
• Training and qualification documents of contractor staffFrom the completion of the work10 years

If there is a dispute, the record is kept until the dispute is concluded. Data whose retention period has expired is deleted or destroyed in the periodic destruction carried out every six months.

If you have a question, the answer comes from us.

Under Article 11 of the Law, you have the following rights:

• aTo learn whether your personal data is processed
• bTo request information if it has been processed
• cTo learn the purpose of processing and whether the data is used in line with that purpose
• çTo know the third parties in Türkiye or abroad to whom the data is transferred
• dTo request rectification if the data is incomplete or inaccurate
• eTo request erasure or destruction within the framework of Article 7 of the Law
• fTo request that the actions taken under (d) and (e) be notified to the third parties to whom the data has been transferred
• gTo object to a result to your detriment arising from analysis exclusively by automated systems
• ğTo claim compensation for damage suffered due to unlawful processing

You may submit your application in writing, to our KEP address, with a secure electronic or mobile signature, or from the e-mail address you have previously notified to us. Applications are concluded free of charge within 30 days at the latest; where the process requires an additional cost, the fee set by the Board may be charged. If you find the response insufficient, you may file a complaint with the Personal Data Protection Board.