CORPORATE

Personal Data Processing Policy

Our dear customers, partners, and visitors; as Sedef Shipbuilding Inc. (“Sedef”, “Sedef Shipbuilding” or “Company”), we place great significance on the protection of your personal data. In this regard, we want to inform you in detail on the topics of collection and processing of your personal data, legal grounds, and mutual rights and obligations in accordance with Turkish Personal Data Protection Law no. 6698 (“PDPL” or “PDP Law”).

This policy hereby aims to provide for the sustainability of the Company’s principle of carrying its activities with transparency. As such, it explains the core principles and practices adopted by the Company to abide by the aforementioned PDP Law. 

This policy relates to natural persons whose data is processed by the Company, via automatic and/or otherwise than by automatic means as long as constituting part of a data filing system.

This policy has been made public by the Company through its website. In case of conflict between this policy and the PDP Law along with the relevant regulation in effect, the terms under PDP Law and the relevant regulation are applied. 

The Company’s right to change this information statement in accordance with any changes that might occur within the Turkish Personal Data Protection Law.

DEFINITIONS

DATA WE ARE PROCESSING

We are processing the below personal data based on the commercial and/or contractual relationship between you and Sedef Shipbuilding.

• Identifying information: Refers to data such as full name, Turkish identity number, tax number, birth date and place, marital status, sex, copy of identity identity card etc.
• Contact information: Refers to data such as address, phone number, email address, fax number, IP address etc.
• Special categories of personal data: Refers to data such as (i) health information taken from the employees as part of personnel and work safety, (ii) biometric data, (iii) any criminal records and union memberships.
• Visual and auditory information: Refers to data such as camera recordings within the Company locations for security and work safety reasons, recordings of phone calls with the call center etc.
• Personnel information: Refers to data such as vocational, academic, and financial information of the employee in addition to basic identifying information and contact details that is collected within the legal framework of the contract employment and kept for the legally mandated personnel files.
• Contract information: Refers to data such as signatures, authorized signatures list, information on natural persons, companies and products that are produced due to legal and commercial relationships of Sedef Shipbuilding with its business partners, suppliers, and external parties.
• Financial information: Refers to data such as financial documents, records, information, bank account, IBAN no etc. that is produced based on the kind and specifics of the legal relationship between Sedef Shipbuilding and the Data Subject.
• Performance information: Refers to data that is processed within the Company for the purpose of internal audit and functionality enhancement, and outside of the Company for the purpose of performance audit of the business partners.
• Other information: Refers to data such as electronic data process security information based on computer and internet use, body measurements for uniforms, location data within the shipyard and work stations, military service postponements, copy of drivers licenses, traffic tickets, information on the service buses employees take and the stops they utilize, and daily employee activity data.

METHOD AND LEGAL CAUSE OF PERSONAL DATA COLLECTION

Personal data is collected verbally, in writing, and electronically for the purposes outlined below, and to provide our services in a legal framework and hence to comply with obligations brought upon us through contracts and laws and regulations in a complete and accurate manner.

Your personal data can be collected and processed (directly from you via resumes, application forms, purchase orders, proposal forms, email communications, phone calls, business card exchanges, messages on Company website, and shared information from Company’s business partners) by Sedef Shipbuilding within the framework of the purposes outlined below and in accordance with conditions outlined in Articles 5 of PDP Law no. 6698; for the signing and execution of contracts, the fulfilment of the legal responsibilities, and for legitimate interests. For security purposes, the Company records all activities in the office buildings and work station facilities, including entrance and exit of visitors, with security cameras. Online activities engaged in while using company internet services are also stored in accordance with laws and regulations.

In addition, the Company processes and archives the personal and contact information shown on your business cards, when they are shared with the Company at its various events and the fairs it participates in, as the personal data has been made public by the data subject himself/herself. The goal here is to carry out the required processes to form trade relations and produce contracts between two companies.

 PURPOSES OF PERSONAL DATA PROCESSING

Your personal data is processed for the purposes outlined below:

• For the Clients:

• Purchasing of goods and services, execution of sales and production processes,
• Conducting customer relations management processes,
• Maintaining the safety and security of the physical spaces,
• Execting operations and activities within the scope of the commercial and contractual relationship, satisfying financial and legal responsibilities,
• Managing and tracking requests and complaints,
• Complying with legal responsibilities,
• Conducting publicity, marketing, and communication activities,
• Conducting finance and accounting activities,
• Informing authorized parties, agencies, and institutes,
• Managing supply chain management processes,
• Conserving necessary data required by the PDP Law,
• Copying and backing up necessary data for the prevention of data loss,
• Checking the consistency of the data provided.

• For the Potential Clients:

In accordance with Article 5.2 of PDP Law, the Company processes the personal and contact information shown on your business cards, when they are shared with the Company at company visits, its various events and the fairs it participates in, as the information is accepted as public information. The purpose here is to carry out the required processes to form trade relations, produce offers for new buildings, steel constructions, and industrial projects, execute contractual agreements, and manage any possible demands and/or complaints.

• For the Business Partners/Suppliers:

Within the scope of the business relationship you have with Sedef Shipbuilding, the personal data of your company officials and employees can be processed for the below listed purposes in accordance to Article 5 of PDP Law and in compliance with the fundamental principles of PDP Law provided that: it is directly related to the establishment or performance of the contract, it is necessary for compliance with a legal obligation, and it is necessary for the legitimate interests pursued by the Company.

• Conducting activities according to the legislation,
• Managing contract processes,
• Conducting finance and accounting activities,
• Managing and tracking legal processes,
• Running internal operations of the Company,
• Managing strategic planning and business partners/suppliers,
• Maintaining the safety and security of the physical spaces,
• Running logistical activities,
• Managing supply chain management processes,
• Conducting processes of goods and services, production, and operations,
• Conserving necessary data required by the PDP Law,
• Copying and backing up necessary data for the prevention of data loss,
• Checking the consistency of the data provided,
• Taking necessary technical and administrative precautions to secure the Company databases and information.

• For the Visitors:

The identifying and contact information collected during your visit to the Company, its offices, and its website along with the security camera recordings in the Company’s physical locations, the necessary body measurements taken during your visit to our locations (such as shoe size for providing special field boots) for work security, and photography and videos taken with your permission which include your visual and auditary data is processed for the purposes below in addition to securing the Company’s and your safety, complying with legal obligations, and fulfilling the legitimate interests pursued by the Company.

• Conducting audit and security activities,
• Running information safety processes,
• Producing and tracking visitor records,
• Maintaining the safety of physical spaces,
• Informing authorized parties, agencies, and institutes,
• Providing for the safety of Data Controller operations,
• Providing internet access and maintaining its safety,
• Satisfying legal responsibilities,
• Managing corporate communication activities and events.

• For the Employee Candidates:

Sedef Shipbuilding processes personal data provided by potential employees on their resumes or application forms submitted through career websites, email, mail, or in person for the below listed purposes and in accordance to Article 5 of PDP Law provided that: it is necessary for the establishment, exercise or protection of any right, it is directly related to the establishment or performance of the contract, and it is necessary for the legitimate interests pursued by the Company. Special Categories of the Personal is processed for a certain amount of time and with explicit consent of the Data Subject.

• Running selection and positioning processes for employee candidates / interns / students,
• Managing application processes for employee candidates,
• Managing human resources operations and specifically recruitment processes,
• Maintaining safety and security of physical spaces and managing business continuity activities,
• Utilizing as evidence in case of legal disputes.

• For the Employees:

Sedef Shipbuilding processes your personal data within the scope of the PDP Law and for the purposes listed below in addition to creating an employee folder, executing a service contract with an employee, and for the legitimate interests and management rights pursued by the Company.

• Running information safety processes,
• Managing employee satisfaction and loyalty processes,
• Complying with responsibilities dictated by the contract of employment and PDP Law,
• Managing side benefit processes for employees,
• Running audit and ethics activities,
• Running educational activities,
• Running syndicate activities,
• Running R&D activities,
• Managing access authorizations,
• Making sure the activities are in line with PDP Law,
• Conducting finance and accounting activities,
• Maintaining the safety of physical spaces,
• Managing assignment and delegation activities,
• Managing and tracking legal processes,
• Planning human resources processes,
• Managing and auditing operations,
• Managing work safety and security operations,
• Collecting and evaluating recommendations for enhancement of work processes,
• Managing business continuity activities,
• Managing performance management activities,
• Informing authorized parties, agencies, and institutes,
• Running management processes,
• Informing government agencies of necessary legal notices, utilizing subsidies provided by government agencies, informing government agencies of relevant auditory notices,
• Conducting human resources processes and specifically personnel activities,
• Providing employee audits and data processing within the scope of the Company’s legitimate management rights.

PURPOSES OF DATA TRANSFER AND THE THIRD PARTIES THE PERSONAL DATA IS TRANSFERRED TO

Your personal data can be transferred in accordance with PDP Law and for the purposes outlined hereby in this Policy to:

• Business Partners and Suppliers the Company works with to provide its services,
• Business Partners, Suppliers, banks, financing institutions that help the Company provide and enhance publicity of its services,
• Agencies that service the Company with website management,
• Lawyers, audit companies, consultants, and other companies Sedef Shipbuilding gets services from,
• Deputies, custodians, and representatives to whom you have assigned authority,
• Authorized agencies and institutes and their appointed officials who have the power to request your personal data such as regulatory and auditory agencies, courts, and offices of bailiff and execution,
• Our parent company Turkon Holding A.Ş. and its group companies such as Kaşif Denizcilik A.Ş., Turkon Konteyner Taşımacılık ve Denizcilik A.Ş., Turkon Lojistik A.Ş., Turkon Taşımacılık A.Ş., Turkon Demiryolu Taşımacılık A.Ş. and Kanlıca Denizcilik ve Ticaret A.Ş.

RIGHTS OF THE DATA SUBJECT ACCORDING TO ARTICLE 11 OF PDP LAW

• Learn whether your personal data has been processed,
• Request information about the data processing if your data has been processed,
• Learn the purpose of processing of personal data and whether data is used in accordance with its purpose,
• Know the third parties in the country or abroad to whom your personal data has been transferred,
• Request rectification in case personal data are processed incompletely or inaccurately,
• Request deletion or destruction of personal data in accordance with the conditions set in PDP Law and in the case the reasons necessitating their processing cease to exist,
• Request notification of the operations made to your personal data to third parties within the scope of Articles 5 and 6 of PDP Law,
• Object the occurrence of any result that is to your detriment by means of analysis or personal data exclusively through automated systems,
• Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data.

ENSURING SECURITY AND PRIVACY OF PERSONAL DATA

Sedef Shipbuilding takes all necessary and appropriate measures to prevent unlawful processing, access to, and transfer of personal data, or any other activities that may cause security failures within the bounds of possibility and depending on the nature of the data.

In this context, Sedef Shipbuilding (i) takes all necessary organizational and technical measures, (ii) establishes internal company audit systems, and (iii) behaves according to precautions set in PDP LAW in case of any unlawful disclosure of personal data.

DESTRUCTION OF PERSONAL DATA

Personal data that is processed will be deleted, destroyed, or anonymized either ex officio or upon request by the data subject in case the reasons necessitating their processing cease to exist, in accordance with PDP Law or in accordance with other relevant laws such as Turkish Commercial Code Law no. 6102 Article 82 and Turkish Criminal Code Article 138, as the maximum period of time necessitated by the purposes for which personal data is processed has passed.

The Company has prepared a Destruction Policy in which it has set out methods of deletion and destruction, and has distributed this document internally. All deletion and destruction processes are handled in according with this said document.

You can send your requests in regards to your rights above in writing or in any other method that may be introduced by the Board of Protection of Personal Data. You can download and fill out the “Application Form” on the Company website with the necessary identifying personal data and can bring a signed copy in person (along with an identity document to show) to the Company address: Tersaneler Caddesi No:10 34940 Tuzla – Istanbul / Turkey, send it through a notary public, send it through methods outlined and allowed under PDP Law, or send a copy to kvkk@sedefshipyard.com email address as a secured and electronically signed attachment.

In the case of connecting us with requests in regards to your rights in accordance with methods outlined above, we will conclude your requests as soon as possible considering the nature of the request and in no longer than 30 days, free of charge, as per Article 13 of PDP LAW.

Company has the right to request idenfifying information from the person(s) applying for personal data matters to confirm the request concerns the same individual whose data is being processed. The Company also can ask questions about the said application to make sure the request is handled properly.