Privacy Policy

As the data controller, Aktif Elektroteknik Sanayi Ve Ticaret Anonim Şirketi (“Aktif” or the “Company”) attaches great importance to protecting the personal data of its customers, employees and other natural persons with whom it has dealings. The process governed by this Aktif Elektroteknik Sanayi Ve Ticaret Anonim Şirketi Personal Data Protection and Processing Policy (the “Policy”), and its intended objective in relation to personal data processing and protection, is the lawful processing and protection of the personal data of our customers, prospective customers, employees, job applicants, visitors, employees of organisations with which we cooperate and third parties.

Information identifying the data controller for all personal data processing activities within the scope of this Policy is provided below. The data controller is Aktif Elektroteknik Sanayi ve Ticaret Anonim Şirketi, operating under the same company name at four different locations. All locations listed below shall collectively be referred to as “Aktif”.

Data Controller : Aktif Elektroteknik Sanayi ve Ticaret Anonim Şirketi

Factory Address : Akşemsettin Mahallesi Çatalca Sokak No:113 Sincan 06930 Ankara / Türkiye

Head Office Address : Şerifali Mahallesi Bayraktar Bulvarı Şehit Sokak No:5 Ümraniye/İstanbul

In this context, Aktif takes the necessary administrative and technical measures for the processing and protection of personal data pursuant to Law No. 6698 and the relevant legislation.

This Policy explains the following fundamental principles adopted by Aktif for personal data processing:

Processing personal data on the basis of explicit consent,
Processing personal data lawfully and in accordance with the rules of good faith,

Keeping personal data accurate and, where necessary, up to date,
Processing personal data for specific, explicit and legitimate purposes,
Processing personal data in a manner that is relevant to, limited to and proportionate to the purposes for which they are processed,
Retaining personal data for the period prescribed by the relevant legislation or required for the purposes for which they are processed,
Providing privacy notices and information to data subjects,
Establishing the necessary system to enable data subjects to exercise their rights,
Taking the necessary measures for the safekeeping of personal data,
Complying with the relevant legislation and the regulations of the Personal Data Protection Board when transferring personal data to third parties as required by the purposes of processing,
Exercising the necessary care in the processing and protection of special categories of personal data.

2 – PURPOSE OF THE POLICY

The purpose of this Policy is to explain the personal data processing activities lawfully carried out by the Company and the systems adopted for the protection of personal data, and to ensure transparency by informing individuals whose personal data are processed by our Company.

3 – SCOPE

This Policy covers all personal data of our employees, customers, job applicants, visitors, employees of organisations with which we cooperate and third parties, processed by automated means or by non-automated means as part of a data filing system.

As the data controller under the Personal Data Protection Law (the “KVK Law”) and the relevant legislation, Aktif sets out in this Policy the fundamental principles adopted for the processing and protection of personal data, the administrative and technical measures taken to protect personal data, and the procedures and principles for determining the maximum retention period required for the purposes of processing, and for erasure, destruction and anonymisation.

For the groups of data subjects in the categories specified above, this Policy may apply in its entirety (e.g. to job applicants who are also visitors), or only certain provisions may apply (e.g. to individuals who are solely visitors).

4 – LEGAL PRINCIPLES OF THE PERSONAL DATA PROTECTION AND PROCESSING POLICY

4.1 GROUPS OF INDIVIDUALS COVERED BY THE POLICY

Data subjects within the scope of this Policy whose data are processed by Aktif are:

Employee: Individuals who have entered into an employment contract with Aktif and work at Aktif.
Job Applicants: Individuals who have not entered into an employment contract with Aktif but are being assessed by Aktif for this purpose.
Representatives and Employees of Companies with Which We Cooperate: Natural persons who are representatives, shareholders or employees of organisations with which Aktif has commercial dealings.
Customer: Natural persons who use or have used the products or services offered by Aktif.
Prospective Customer: Natural persons who have expressed a wish to use our products and services or who, in accordance with commercial practices and the rules of good faith, are considered likely to have such an interest.
Visitor: Natural persons who have entered Aktif’s physical premises for various purposes or who visit our website.
Third Party: Other individuals who do not fall within the scope of this Policy.

4.2 PURPOSES OF PROCESSING PERSONAL DATA

The Company processes personal data only for the purposes and under the conditions set out in the personal data processing conditions specified in Article 5(2) and Article 6(3) of the KVK Law. These purposes and conditions are:

The Company’s relevant activity involving the processing of personal data is expressly provided for by law,
The processing of personal data by the Company is directly related to and necessary for the conclusion or performance of a contract,
The processing of personal data is necessary for the Company to fulfil its legal obligations,
Provided that the personal data have been made public by the data subject, the Company processes them only for the purpose for which the data subject made them public,
The processing of personal data by the Company is necessary for the establishment, exercise or protection of the rights of the Company, data subjects or third parties,
The processing of personal data is necessary for the Company’s legitimate interests, provided that it does not prejudice the data subject’s fundamental rights and freedoms,
The Company’s processing of personal data is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to express consent due to factual or legal incapacity,
For special categories of personal data other than data concerning the data subject’s health and sexual life, processing is provided for by law,
For special categories of personal data concerning the data subject’s health and sexual life, processing is carried out by persons subject to a duty of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

In this context, the Company processes your personal data for the following purposes:

Conducting employee recruitment processes,
Planning and conducting intern and student recruitment, placement and operational processes,
Planning human resources processes,
Fulfilling obligations towards employees arising from employment contracts and legislation,
Monitoring and supervising employees’ work activities,
Planning and administering employee benefits and entitlements,
Planning and conducting employee exit procedures,
Planning and conducting employee performance assessment processes,
Planning and conducting training activities,
Remuneration management,
Monitoring employee assignment processes,
Conducting occupational health and safety processes,
Planning and conducting service procurement processes,
Planning and conducting information security processes,
Planning and conducting corporate communication activities,
Monitoring finance and accounting operations,
Planning and conducting activities to ensure business continuity,
Managing relationships with customers and suppliers,
Monitoring and conducting litigation and legal proceedings,
Managing requests and complaints,

Conducting corporate governance activities,
Creating and maintaining visitor records.

Where a processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the KVK Law, the Company obtains the data subject’s explicit consent for the relevant processing activity.

5 – MATTERS RELATING TO THE PROCESSING AND PROTECTION OF PERSONAL DATA

5.1 MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

In accordance with Article 20 of the Constitution and Article 4 of the KVK Law, our Company processes personal data lawfully and in accordance with the rules of good faith, ensures that they are accurate and, where necessary, up to date, pursues specific, explicit and legitimate purposes, and processes them in a manner that is relevant to, limited to and proportionate to those purposes. Our Company retains personal data for the period prescribed by law or required for the purposes of processing.

Pursuant to Article 20 of the Constitution and Article 5 of the KVK Law, our Company processes personal data on the basis of one or more of the conditions set out in Article 5 of the KVK Law concerning the processing of personal data.

Our Company complies with the rules governing the processing of special categories of personal data in accordance with Article 6 of the KVK Law.

In accordance with Articles 8 and 9 of the KVK Law, our Company complies with the rules stipulated by law and established by the Personal Data Protection Board concerning the transfer of personal data.

Our Company provides privacy notices to data subjects in accordance with Article 10 of the KVK Law, requests their consent where consent is required, and processes such personal data on the basis of the criteria set out below.

5.1.1 Processing Personal Data in Accordance with the Principles Prescribed by Legislation

5.1.1.1 Lawful Processing in Accordance with the Rules of Good Faith

Our Company complies with the principles introduced by legal regulations and the general principles of trust and good faith when processing personal data. In this context, our Company considers the requirements of proportionality and does not use personal data beyond what is required for the relevant purpose.

5.1.1.2 Ensuring That Personal Data Are Accurate and, Where Necessary, Up to Date

Our Company ensures that the personal data it processes are accurate and up to date, taking into account data subjects’ fundamental rights and its own legitimate interests. It takes the necessary measures accordingly.

5.1.1.3 Processing for Specific, Explicit and Legitimate Purposes

Our Company clearly and precisely identifies legitimate and lawful purposes for processing personal data. Our Company processes personal data only to the extent that they are related to and necessary for the services it provides. The purposes for which our Company will process personal data are determined before the processing activity begins.

5.1.1.3.1 Being Relevant to, Limited to and Proportionate to the Purposes of Processing

Our Company processes personal data in a manner suitable for achieving the specified purposes and avoids processing personal data that are unrelated to or unnecessary for achieving those purposes. For example, personal data are not processed to meet needs that may arise in the future.

5.1.1.3.2 Retention for the Period Prescribed by the Relevant Legislation or Required for the Purposes of Processing

Our Company retains personal data only for the period specified in the relevant legislation or required for the purposes of processing. Accordingly, our Company complies with the time limits arising from Article 138 of the Turkish Criminal Code and Articles 4 and 7 of the KVK Law. Upon expiry of this period, or when the reasons requiring processing cease to exist, our Company erases, destroys or anonymises the personal data.

5.1.2 Conditions for Processing Personal Data

Pursuant to Article 20(3) of the Constitution and Article 5 of the KVK Law, personal data may only be processed in circumstances provided for by law or with the individual’s explicit consent. In this regard, and in accordance with the Constitution, our Company processes personal data only in circumstances provided for by law or with the individual’s explicit consent. However, Article 5(2) of the KVK Law also permits processing where explicit consent is absent. Personal data may also be processed where one of the other conditions set out below is met. A personal data processing activity may be based on only one of the conditions specified below, or more than one of these conditions may serve as the basis for the same activity. Where the data processed are special categories of personal data, the conditions set out below apply.

In addition to explicit consent, personal data may also be processed where one of the other conditions set out below is met. A personal data processing activity may be based on only one of the conditions specified below, or more than one of these conditions may serve as the basis for the same activity. Where the data processed are special categories of personal data, the conditions set out below apply.

Although the legal grounds on which our Company processes personal data may differ, all personal data processing activities comply with the general principles set out in Article 4 of the KVK Law.

5.1.2.1 Existence of the Data Subject’s Explicit Consent

One of the conditions for processing personal data is the data subject’s explicit consent. Such consent must relate to a specific matter, be based on information provided, and be given freely.

Where personal data processing depends on the data subject’s explicit consent, the Company obtains employees’ explicit consent through the relevant methods.

5.1.2.2 Express Provision by Law

A data subject’s personal data may be lawfully processed where this is expressly provided for by law.

5.1.2.3 Inability to Obtain the Data Subject’s Explicit Consent Due to Factual Impossibility

A data subject’s personal data may be processed where processing is necessary to protect the life or physical integrity of that person or another person, and the person is unable to express consent due to factual impossibility or their consent cannot be deemed valid.

5.1.2.4 Direct Relevance to the Conclusion or Performance of a Contract

Personal data may be processed where processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract.

5.1.2.5 Fulfilment of the Company’s Legal Obligations

A data subject’s personal data may be processed where processing is necessary for our Company to fulfil its legal obligations as the data controller.

The Data Subject Making Their Personal Data Public

The relevant personal data, where they have been made public by the data subject themselves.

5.1.2.6 Necessity of Data Processing for the Establishment or Protection of a Right

A data subject’s personal data may be processed where processing is necessary for the establishment, exercise or protection of a right.

5.1.2.7 Necessity of Data Processing for Our Company’s Legitimate Interests

A data subject’s personal data may be processed where processing is necessary for our Company’s legitimate interests, provided that it does not prejudice the data subject’s fundamental rights and freedoms.

5.1.3 Processing Special Categories of Personal Data

Our Company takes particular care to comply with the rules stipulated in the KVK Law when processing personal data classified as “special categories” under that Law.

Article 6 of the KVK Law classifies certain personal data as “special categories” because their unlawful processing carries a risk of causing harm or discrimination. These data concern race, ethnic origin, political opinion, philosophical belief, religion, denomination or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

In accordance with the KVK Law, our Company processes special categories of personal data in the following circumstances, provided that the adequate measures to be determined by the Personal Data Protection Board are taken:

Where the data subject has given explicit consent; or
Where the data subject has not given explicit consent:
Special categories of personal data other than data concerning the data subject’s health and sexual life are processed in circumstances provided for by law,
Special categories of personal data concerning the data subject’s health and sexual life are processed solely for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing,

by persons subject to a duty of confidentiality or by authorised institutions and organisations.

5.1.4 Transfer of Personal Data

Aktif complies with the personal data transfer conditions set out in Articles 8 and 9 of the KVK Law when transferring personal data.

Transfer of Personal Data Within Türkiye

Pursuant to Article 8 of the KVK Law, Aktif complies with the data processing conditions in its domestic data transfer activities.

Transfer of Personal Data Abroad

Pursuant to Article 9 of the KVK Law, Aktif may transfer personal data abroad in compliance with the personal data processing conditions, provided that the destination country is among the countries declared by the Personal Data Protection Board to provide adequate protection, or, if adequate protection is not available in the relevant foreign country, the data controllers in Türkiye and that country undertake in writing to provide adequate protection and permission is obtained from the Personal Data Protection Board.

Groups of Recipients to Whom Aktif Transfers Personal Data

In accordance with Articles 8 and 9 of the KVK Law, Aktif may transfer the personal data of data subjects within the scope of this Policy to the groups listed below for the specified purposes:

Only for the purpose of ensuring that commercial activities are carried out,
To Aktif’s Suppliers, limited to what is procured from the supplier and the conduct of Aktif’s commercial activities,
To authorised public institutions and organisations and authorised persons governed by private law, limited to the purpose requested within their legal authority,
To third parties in accordance with the personal data transfer conditions.

5.2 MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

5.2.1 Measures Taken to Ensure the Lawful Processing of Personal Data

Our Company takes technical and administrative measures to ensure that personal data are processed lawfully, taking into account technological capabilities and implementation costs.

Our Company takes technical and administrative measures to ensure that personal data are processed lawfully, taking into account technological capabilities and implementation costs. Employees are informed that they may not disclose personal data obtained by them to others in breach of the KVK Law or use such data for purposes other than processing, and that this obligation continues after they leave their positions. The necessary undertakings are obtained from them accordingly.
Our Company raises awareness among data processors to whom it transfers personal data, such as business partners and suppliers, regarding the prevention of unlawful processing, the prevention of unlawful access, and the lawful safekeeping of personal data. It takes the necessary measures to ensure that suppliers process personal data in accordance with the KVK Law.
Our Company enters into supplementary agreements with the recipients to whom personal data are lawfully transferred. These agreements contain provisions requiring recipients to take the necessary security measures to protect personal data and to ensure compliance with these measures within their own organisations.

5.2.2 Measures Taken to Prevent Unlawful Access to Personal Data

Our Company takes technical and administrative measures, taking into account the nature of the data to be protected, technological capabilities and implementation costs, to prevent negligent or unauthorised disclosure, access or transfer of personal data, and all other forms of unlawful access.

New technological developments are monitored, technical measures are implemented in systems, particularly in cybersecurity, and these measures are periodically updated and renewed.
Technical access and authorisation solutions are implemented in line with the legal compliance requirements identified for each department within our Company.
Access rights are restricted and regularly reviewed. Access restrictions are applied to former employees, and their accounts are closed.
Software and hardware incorporating antivirus systems, safeguards against data vulnerabilities and firewalls are installed.

5.2.3 Auditing the Measures Taken to Protect Personal Data

In accordance with Article 12 of the KVK Law, our Company conducts or commissions the necessary internal audits. The results are reported to the relevant department as part of the Company’s internal operations, and the necessary activities are carried out to improve the measures taken.

5.2.4 Measures to Be Taken in the Event of Unlawful Disclosure of Personal Data

If personal data processed by Aktif are unlawfully obtained by unauthorised persons, Aktif notifies the Personal Data Protection Board and the relevant data subjects within 72 hours.

5.3 PERSONAL DATA RETENTION PERIODS

Where the relevant laws and legislation prescribe a retention period, our Company retains personal data for the period specified therein.

Where the legislation does not specify how long personal data must be retained, such data are processed for the period required by the activity for which our Company processes them, in accordance with Company practices and commercial customs, and are subsequently erased, destroyed or anonymised.

Where the purpose of processing has ended and the retention periods prescribed by the relevant legislation and determined by our Company have expired, personal data may be retained solely as evidence in possible legal disputes, to assert a right associated with the data or to establish a defence. These retention periods are determined on the basis of the limitation periods for asserting the relevant right and examples of previous requests made to the Company on the same matters even after those limitation periods expired. In such cases, the retained personal data are not accessed for any other purpose and are accessed only when required for the relevant legal dispute. Once this period also expires, the personal data are erased, destroyed or anonymised.

5.4 TECHNIQUES FOR THE ERASURE, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA

As provided in Article 138 of the Turkish Criminal Code and Article 7 of the KVK Law, even where personal data have been processed in accordance with the relevant legal provisions, they are erased, destroyed or anonymised upon the Company’s decision or the data subject’s request when the reasons requiring processing cease to exist. To fulfil this obligation, our Company has taken the necessary internal technical and administrative measures and developed the necessary operating mechanisms. It trains the relevant business units, assigns responsibilities and raises awareness to ensure compliance with these obligations.

5.4.1 Techniques for the Erasure and Destruction of Personal Data

Even where personal data have been processed in accordance with the relevant legal provisions, the Company may erase or destroy them on its own decision or at the data subject’s request when the reasons requiring processing cease to exist. The erasure or destruction techniques most commonly used by the Company are listed below:

Physical Destruction (Physical Destruction): Personal data may also be processed by non-automated means, provided that they form part of a data filing system. When such data are erased or destroyed, a method of physical destruction is used to ensure that the personal data cannot subsequently be used.

Secure Deletion from Software (Secure Deletion Software): When data processed wholly or partly by automated means and stored digitally are erased or destroyed, methods are used to delete the data from the relevant software so that they cannot be recovered.

Secure Deletion by a Specialist (Sending to a Specialist for Secure Deletion): In certain circumstances, the Company may engage a specialist to erase personal data on its behalf. In such cases, the specialist securely erases or destroys the personal data so that they cannot be recovered.

5.4.2 Techniques for Anonymising Personal Data

Anonymisation means rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching them with other data. The Company may anonymise lawfully processed personal data when the reasons requiring their processing cease to exist.

In accordance with Article 28 of the KVK Law, anonymised personal data may be processed for purposes such as research, planning and statistics. Such processing falls outside the scope of the KVK Law and does not require the data subject’s explicit consent. The anonymisation techniques most commonly used by the Company are listed below.

Masking (Masking): Data masking is a method of anonymising personal data by removing the principal identifying information from the dataset.

Aggregation (Aggregation): The aggregation method combines multiple data items, rendering personal data incapable of being associated with any individual.

Data Derivation (Data Derivation): The data derivation method produces more general content from personal data, ensuring that the personal data cannot be associated with any individual.

Data Shuffling (Data Shuffling, Permutation): The data shuffling method rearranges values within a personal dataset to break the link between those values and individuals.

5.5 PROVIDING PRIVACY NOTICES AND INFORMATION TO DATA SUBJECTS

Aktif provides privacy notices to data subjects when collecting personal data, in accordance with Article 10 of the KVK Law. In this context, when collecting personal data, our Company informs data subjects of its identity, the purposes for which their personal data will be processed, the recipients and purposes of any transfers, the method and legal grounds for collecting personal data, and the data subject’s rights under Article 11 of the KVK Law.

Article 20 of the Constitution establishes everyone’s right to be informed about personal data concerning them. Accordingly, Article 11 of the KVK Law includes the “right to request information” among data subjects’ rights. In this context, our Company provides the necessary information when requested by a data subject, in accordance with Article 20 of the Constitution and Article 11 of the KVK Law.

In addition, our Company informs data subjects and other relevant persons through publicly available documents, primarily this Policy, that it processes personal data in accordance with all provisions of the KVK Law, particularly the principles of “lawfulness and good faith”. This informs the relevant persons about processing activities and ensures accountability and transparency. Our Company also provides information to relevant persons through various other methods about its activities and the provisions of the Law, particularly when seeking their “explicit consent”.

5.6 DATA SUBJECTS’ RIGHTS AND REQUESTS

Aktif maintains the necessary channels, internal procedures, and administrative and technical arrangements in accordance with Article 13 of the KVK Law to assess data subjects’ rights and provide them with the necessary information.

Where data subjects submit written requests to our Company concerning the rights listed below, our Company resolves the request free of charge within no more than thirty days, depending on its nature. However, if the Personal Data Protection Board prescribes a fee, our Company charges the applicant the fee set out in the tariff determined by the Board. Data subjects have the right to:

Learn whether their personal data are being processed,
Request information if their personal data have been processed,
Learn the purposes of processing and whether their personal data are used in accordance with those purposes,
Know the third parties to whom their personal data are transferred domestically or abroad,
Request rectification of incomplete or inaccurate personal data and request notification of the action taken to the third parties to whom the personal data have been transferred,
Request the erasure or destruction of personal data when the reasons requiring processing cease to exist, even if the data have been processed in accordance with the KVK Law and other relevant laws, and request notification of the action taken to the third parties to whom the personal data have been transferred,
Object to a result that is detrimental to them arising from the analysis of processed data exclusively through automated systems,
Request compensation for damage suffered as a result of the unlawful processing of personal data.

Pursuant to Article 13(1) of the Personal Data Protection Law, data subjects must submit requests to exercise the above rights to our Company “in writing” or through other methods determined by the Personal Data Protection Board.

To enable faster and more effective responses, data subjects should submit their requests to our Company together with the information necessary to establish their identity and an explanation of the rights they wish to exercise, specifying which of the rights listed in Article 11 of the Law their request concerns.

Requests explaining the right the data subject wishes to exercise under Article 11 of the KVK Law may be delivered in person to Akşemsettin Mahallesi Çatalca Sokak No:113 Sincan 06930 Ankara, together with documents establishing the data subject’s identity; sent through a notary or by other methods specified in the KVK Law; or submitted by completing the “Data Subject (Personal Data Owner) Application Form” available at www.aktif.net.

For a third party to submit an application on behalf of a data subject, a special power of attorney must have been issued through a notary by the data subject in the name of the person submitting the application.

Circumstances in Which Data Subjects Cannot Assert Their Rights

Pursuant to Article 28 of the KVK Law, the following circumstances fall outside the scope of the Law, and data subjects cannot assert their rights in relation to them:

Processing personal data for official statistics or, after anonymisation, for purposes such as research, planning and statistics.
Processing personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defence, national security, public security, public order, economic security, privacy or personality rights, or constitute a criminal offence.
Processing personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised and assigned by law to ensure national defence, national security, public security, public order or economic security.
Processing personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or enforcement proceedings.

Pursuant to Article 28(2) of the Law, data subjects cannot assert rights other than the right to claim compensation for damage in the following circumstances:

Personal data processing is necessary to prevent a criminal offence or for a criminal investigation.
Processing personal data made public by the data subject themselves.
Personal data processing is necessary for authorised and competent public institutions and organisations and professional organisations with public institution status to perform supervisory or regulatory duties or conduct disciplinary investigations or proceedings under powers granted by law.
Personal data processing is necessary to protect the State’s economic and financial interests in relation to budgetary, tax and financial matters.

Our Company’s Right to Reject a Data Subject’s Application

Our Company may reject an applicant’s request in the following circumstances, explaining the grounds for rejection:

Processing personal data for official statistics or, after anonymisation, for purposes such as research, planning and statistics.
Processing personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defence, national security, public security, public order, economic security, privacy or personality rights, or constitute a criminal offence.
Processing personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised and assigned by law to ensure national defence, national security, public security, public order or economic security.
Processing personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or enforcement proceedings.
Personal data processing is necessary to prevent a criminal offence or for a criminal investigation.
Processing personal data made public by the data subject themselves.
Personal data processing is necessary for authorised and competent public institutions and organisations and professional organisations with public institution status to perform supervisory or regulatory duties or conduct disciplinary investigations or proceedings under powers granted by law.
Personal data processing is necessary to protect the State’s economic and financial interests in relation to budgetary, tax and financial matters.
The data subject’s request may impede the rights and freedoms of other individuals.
The request requires disproportionate effort.
The requested information is publicly available.
One of the circumstances excluded from the scope of the Law applies.

5.7 CATEGORISATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND OF RECIPIENTS

5.7.1 Categorisation of Personal Data

Our Company processes personal data in the categories listed below for its legitimate and lawful purposes, on the basis of and limited to one or more of the processing conditions specified in Article 5 of the KVK Law, in compliance with the general principles of that Law, particularly those set out in Article 4 concerning the processing of personal data, and with all obligations imposed by the Law, and within the periods specified in this Policy. The relevant persons are informed in accordance with Article 10 of the KVK Law. This Policy also specifies which data subjects covered by it are associated with the personal data processed in these categories.

Personal Data Categorisation	Description
Identity Information	Data containing information about a person’s identity, including documents such as driving licences, identity cards and passports containing information such as full name, Turkish identity number, nationality, mother’s and father’s names, place and date of birth and gender, as well as tax number, social security number, signature information, vehicle registration number and similar information.
Contact Information	Information such as telephone number, address, email address, fax number and IP address.
Location Data	Information identifying a person’s location while using Company vehicles, such as GPS location and travel data.
Customer Information	Information obtained and generated about the relevant person through our Company’s commercial activities and the operations carried out by our business units in this context.
Family Members and Relatives Information	Information about the data subject’s family members (e.g. spouse, mother, father and children) and relatives, and emergency contact information, processed within the operations of the Company’s business units to protect the legal and other interests of the Company and the data subject.
Physical Premises Security Information	Personal data relating to records and documents collected upon entry to and during a stay at physical premises, such as camera recordings and records collected at security checkpoints.
Financial Information	Personal data processed in relation to information, documents and records showing any financial consequences arising from the type of legal relationship established between the Company and the data subject, as well as data such as bank account number, IBAN, credit card information, financial profile, assets and income information.
Transaction Security Information	Personal data processed to ensure the technical, administrative, legal and commercial security of both the data subject and the Company during the Company’s commercial activities.
Personnel Information	All personal data processed to obtain information forming the basis of the employment entitlements of natural persons in an employment relationship with the Company.
Job Applicant Information	Natural persons who have applied for a job with the Company by any means or have made their CV and relevant information available for our Company’s review.
Special Categories of Personal Data	Data specified in Article 6 of the KVK Law (e.g. health data including blood group, biometric data, religion and information about association membership).
Legal Proceedings and Compliance Information	Your personal data processed to identify and pursue our legal claims and rights, fulfil our debts, and comply with our statutory obligations and the Company’s Policies.
Request/Complaint Management Information	Personal data clearly relating to an identified or identifiable natural person, processed partly or wholly by automated means or by non-automated means as part of a data filing system, concerning the receipt and assessment of any requests or complaints submitted to the Company.

5.7.2 Categorisation of Recipients

In accordance with Articles 8 and 9 of the KVK Law, Aktif may transfer the personal data of data subjects covered by the Policy to the following categories of recipients:

Business partners and Suppliers,
Legally Authorised Public Institutions and Organisations,
Legally Authorised Persons Governed by Private Law.

The scope of the recipients specified above and the purposes of data transfers are set out below.

Potential Data Recipients	Definition	Purpose of Data Transfer
Business Partner	Parties with which business partnerships are established during commercial activities for purposes such as the sale, promotion and marketing of products and services, after-sales support and joint customer loyalty programmes.	Limited to ensuring fulfilment of the purposes for which the business partnership was established.
Supplier	Parties providing services to the Company on a contractual basis in accordance with our Company’s instructions during its commercial activities.	Limited to ensuring the provision to the Company of outsourced services procured from suppliers that are necessary for our Company’s commercial activities.
Legally Authorised Public Institutions and Organisations	Public institutions and organisations authorised to obtain information and documents from our Company under the relevant legislation.	Limited to the purpose requested by the relevant public institutions and organisations within their legal authority.
Legally Authorised Persons Governed by Private Law	Persons governed by private law authorised to obtain information and documents from our Company under the relevant legislation.	Limited to the purpose requested by the relevant persons governed by private law within their legal authority.

6 – PERSONAL DATA PROCESSING AT BUILDING AND FACILITY ENTRANCES AND WITHIN BUILDINGS AND FACILITIES AND WEBSITE VISITORS

6.1 PERSONAL DATA PROCESSING ACTIVITIES AT BUILDING AND FACILITY ENTRANCES AND WITHIN THE PREMISES

To ensure security, our Company processes personal data through security camera monitoring and the tracking of visitors’ entries and exits at its buildings and facilities.

Our Company processes personal data by using security cameras and recording visitors’ entries and exits.

The Company’s security camera monitoring activities aim to protect its interests in ensuring the safety of the Company and other persons. In this context, our Company acts in accordance with the Constitution, the KVK Law and other relevant legislation.

Video recordings of our visitors are made through camera monitoring systems at building and facility entrances and within our facilities.

Through security camera monitoring, our Company aims to improve the quality and reliability of its services, ensure the safety of the Company, customers and other persons, and protect customers’ interests in the services they receive.

Our Company complies with the provisions of the KVK Law when conducting camera monitoring for security purposes.

Our Company’s camera monitoring activities are carried out in accordance with the Law on Private Security Services and the relevant legislation.

Only a limited number of Company employees and, where necessary, authorised persons can access recordings stored digitally. Those with access declare, through the confidentiality undertaking they have signed, that they will protect the confidentiality of the data they access.

In accordance with Article 12 of the KVK Law, our Company takes the necessary technical and administrative measures to ensure the security of personal data obtained through camera monitoring.

In addition to the camera recordings mentioned above, our Company processes personal data to track visitors’ entries and exits at its buildings and facilities for security and the purposes specified in this Policy.

Data subjects visiting our Company’s buildings are informed when their names and surnames are collected, or through notices displayed at the Company or otherwise made available to visitors. Data obtained to track visitors’ entries and exits are processed solely for this purpose, or the relevant personal data are recorded in a physical data filing system.

For security and the purposes specified in this Policy, our Company may provide internet access to visitors who request it during their stay in our buildings and facilities. In such cases, logs relating to internet access are recorded pursuant to the mandatory provisions of Law No. 5651 and the legislation issued under that Law. These records are processed only when requested by authorised public institutions and organisations or to fulfil our relevant legal obligations during internal Company audits.

No Company employee has access to the logs obtained in this context. Company employees who have access to these records access them solely for use in response to requests from authorised public institutions and organisations or during audits, and share them with legally authorised persons. The limited number of persons with access declare, through a confidentiality undertaking, that they will protect the confidentiality of the data they access.

7 – GOVERNANCE STRUCTURE OF THE PERSONAL DATA PROTECTION AND PROCESSING DECLARATION

Aktif has established a “Personal Data Protection Unit” to provide the necessary coordination within the Company to establish, maintain and sustain compliance with personal data protection legislation. The Personal Data Protection Unit is responsible for ensuring coordination among Aktif’s units and departments and for operating and improving the systems established to ensure that activities comply with personal data protection legislation. The duties of this committee are set out below.

Preparing the fundamental Policies on Personal Data Protection and Processing, and amendments where necessary, and submitting them to senior management for approval and implementation.
Deciding how the Policies on Personal Data Protection and Processing are to be implemented and audited, and submitting matters relating to internal assignments and coordination within this framework to senior management for approval.
Identifying the actions necessary to comply with the Personal Data Protection Law and relevant legislation, submitting them to senior management for approval, overseeing their implementation and ensuring coordination.
Raising awareness of Personal Data Protection and Processing within the Company and among its suppliers.
Identifying risks that may arise in the Company’s personal data processing activities and ensuring that necessary measures are taken, and submitting improvement proposals to senior management for approval.
Designing training on personal data protection and the implementation of Policies, and ensuring its delivery.
Making final decisions at the highest level on data subjects’ applications.
Coordinating information and training activities to ensure that data subjects are informed about personal data processing activities and their statutory rights.
Monitoring developments and regulations concerning Personal Data Protection and advising senior management on actions required within the Company in response to them.
Coordinating relations with the Personal Data Protection Board and Authority.
Carrying out other duties concerning personal data protection assigned by the Company’s senior management.

8 – REVIEW

This Policy enters into force upon approval by Aktif’s Board of Directors. Where the provisions of this Policy conflict with applicable legislation, particularly Law No. 6698, the legislation prevails. The Company reserves the right to amend this Policy in line with legal regulations. The current version of the Policy is available on Aktif’s website (www.aktif.net).

The Policy has been prepared by translating the rules established by the relevant legislation into specific arrangements for their implementation. Our Company carries out the necessary system development and preparations to comply with the effective dates stipulated in the KVK Law.

Quick Menu

Sectors

Quick Quote Request