DAP GAYRİMENKUL GELİŞTİRME ANONİM ŞİRKETİ NOTICE ON THE PROTECTION OF PERSONAL DATA UNDER LAW NO. 6698
1. Identity of the Data Controller
DAP Gayrimenkul Geliştirme Anonim Şirketi (“Company”), acting as the data controller within the scope of Law No. 6698 on the Protection of Personal Data (“KVKK”), processes the personal data of employees, job applicants, customers, potential customers, visitors, suppliers, and authorized representatives and employees of business partners, shareholders, interns, and other relevant persons, depending on the Company’s field of activity and the category of the data subject, in accordance with the KVKK and relevant legislation. This Notice has been prepared for the purpose of informing the relevant persons pursuant to Article 10 of the KVKK.
2. Personal Data Processed
Depending on the nature of the data subject, the following personal data may be processed by the Company:
• Identity information,
• Contact information,
• Employment information,
• Professional experience information,
• Financial information,
• Legal transaction information,
• Customer transaction information,
• Transaction security information,
• Physical premises security information,
• Visual and audio records,
• Request and complaint information,
• Health data and other special categories of personal data that may be processed in cases prescribed by law.
3. Purposes of Processing Personal Data
Your personal data, and, depending on the nature of the processed data and to the extent necessary, your special categories of personal data, may be processed by the Company for the following purposes:
• Planning and execution of human resources processes,
• Recruitment and evaluation of job applicants,
• Managing the processes related to the establishment, administration, and termination of employment contracts,
• Execution of personnel and payroll processes,
• Execution of occupational health and safety activities,
• Execution of training, performance management, and career development processes,
• Execution of goods and services sales processes,
• Execution of customer relations management activities,
• Provision of after-sales support services,
• Management of requests and complaints,
• Execution of finance and accounting activities,
• Execution of contract processes,
• Management of supply chain, procurement, and relations with business partners,
• Ensuring physical premises security,
• Execution of information security processes,
• Management of access authorizations and ensuring the security of the data controller’s operations,
• Follow-up and execution of legal affairs,
• Providing information to authorized persons, institutions, and organizations,
• Audit, risk management, and execution of company activities in compliance with legislation,
• Ensuring business continuity and execution of project development and operational processes,
• Execution of marketing, advertising, and campaign activities,
• Fulfilment of the requirements of the commercial activities carried out by our Company,
• Determination of our Company’s commercial, operational, and business strategies; identification of suitable products, projects, and services,
• Conducting activities aimed at customer satisfaction,
• Execution of business carried out with our business partners,
• Carrying out storage and archiving activities.
4. Methods and Legal Grounds for Collection of Personal Data
Your personal data, and, depending on the nature of the processed data and to the extent necessary, your special categories of personal data, are obtained through physical and electronic means, via the website, contact forms, career applications, sales offices, call center, contracts, e-mail correspondence, camera systems, and similar channels, by automated or non-automated means.
Your personal data are processed on the basis of one or more of the following legal grounds:
• Expressly provided for by law,
• Necessarily related to the establishment or performance of a contract,
• Necessary for the Company to fulfil its legal obligations,
• The personal data have been made public by the data subject,
• Necessary for the establishment, exercise, or protection of a right,
• The existence of the Company’s legitimate interests, provided that the fundamental rights and freedoms of the data subject are not harmed,
• The data subject’s explicit consent,
• With respect to special categories of personal data, the existence of the conditions set forth in Article 6 of the KVKK.
Your personal data are processed in accordance with the law and the rules of honesty, accurately and, where necessary, up to date, for specific, explicit, and legitimate purposes, limited and proportionate to the purposes for which they are processed, and are securely retained in physical and electronic environments for the period prescribed by the relevant legislation or required by the purpose of processing.
5. Transfer of Personal Data
Your personal data, and, depending on the nature of the processed data and to the extent necessary, your special categories of personal data, may be transferred in accordance with the fundamental principles set forth in the KVKK and within the framework of the transfer conditions regulated under Articles 8 and 9 of the KVKK, for the purpose of achieving the purposes set out above, to:
• business partners,
• suppliers and persons and entities from whom services are obtained for the conduct of our activities (and/or to third-party business partners with whom sharing is required for the performance of the work),
• our shareholders, and companies in which our shareholders directly or indirectly hold shares, or with which they have business relationships within the scope of our activities,
• independent audit firms,
• financial institutions and banks,
• insurance companies,
• the relevant authorized institutions and organizations within the scope of land registry transactions and similar official transactions,
• site managements,
• notaries,
• legally authorized public institutions and organizations,
• legally authorized private persons/entities,
• our service providers from whom we obtain support in the fields of storage, archiving, information technology support (server, hosting, software, cloud computing, etc.), both domestically and/or abroad, who process personal data on behalf of our Company,
in accordance with the legislation.
6. Transfer of Data Abroad
As a rule, your personal data, and, depending on the nature of the processed data and to the extent necessary, your special categories of personal data, are not transferred abroad by our Company.
However, where transfer of data abroad is necessary, the transfer shall be carried out in accordance with the procedure and principles regulated under Article 9 of the KVKK or in accordance with other transfer conditions regulated under the Law; where necessary, the relevant persons shall be informed separately and the obligations prescribed under the legislation shall be fulfilled.
7. Security of Personal Data
Our Company takes the necessary technical and administrative measures and carries out the necessary audits within the scope of Article 12 of the KVKK in order to prevent unlawful processing of and unlawful access to personal data and to ensure the safekeeping of personal data.
8. Rights of the Data Subject
Pursuant to Article 11 of the KVKK, data subjects have the right to:
• Learn whether personal data are processed,
• Request information if their personal data have been processed,
• Learn the purpose of the processing of personal data and whether they are used in accordance with such purpose,
• Know the third parties to whom personal data are transferred domestically or abroad,
• Request correction if personal data are incomplete or inaccurately processed,
• Request the deletion or destruction of personal data within the framework of the conditions stipulated in the KVKK,
• Request notification to third parties to whom personal data has been transferred in the event of the correction, deletion, or destruction of such data,
• Object to any result arising against the person through the analysis of processed data exclusively by automated systems,
• Claim compensation for damages in case of damage due to the unlawful processing of personal data.
Your personal data collected and processed by us must be accurate and, where necessary, up to date pursuant to Article 4 of Law No. 6698 on the Protection of Personal Data. Therefore, if any change occurs in your personal data, you may notify your up-to-date and accurate personal information through the methods set out below.
9. Application Procedure
You may submit your requests regarding the rights you have under Article 11 of the KVKK, in accordance with the provisions of the Communiqué on the Procedures and Principles of Application to the Data Controller, by delivering them in writing to the address Altayçeşme Mahallesi, Zeytindalı Sokak, No:16 B Blok Maltepe/İstanbul, or by signing them with a secure electronic signature or mobile signature as defined in the Electronic Signature Law No. 5070 and sending them to our Company’s KEP address dapgayrimenkul@hs01.kep.tr. Your applications shall be concluded free of charge as soon as possible and in any event within thirty (30) days depending on their nature. However, if the process requires an additional cost, the fee set forth in the tariff determined by the Personal Data Protection Board may be charged.
