Personal Data Processing and Protection Policy

Introduction, Scope, and Definitions

The Personal Data Protection Law No. 6698 (“PDPL”) entered into force on 07.04.2016 and regulates the protection of individuals’ personal data comprehensively. This Personal Data Processing and Protection Policy (“Policy”) has been prepared by Atlas Trafo A.Ş. (“Company/Our Company”) to outline how the Company implements the rules specified by the PDPL and relevant legislation.

Our Company performs necessary internal arrangements for compliance with this Policy and ensures continuity by maintaining internal audit mechanisms.

Scope

This Policy covers all personal data processed by our Company—whether automatically or non-automatically—belonging to employees, former employees, employee candidates, interns, group employees, employee relatives, shareholders/partners, company officials, customers, potential customers, visitors, supplier employees, and supplier representatives, as defined in section 1.3 of the Policy.

Definitions

Definitions not included in this Policy shall bear the meanings specified in the PDPL and secondary legislation.

Principles for Personal Data Processing

Our Company processes personal data in accordance with the following fundamental principles:

Lawfulness and fairness: All personal data processing activities comply with applicable laws.
Accuracy and up-to-dateness: Personal data is kept accurate and updated as necessary.
Specified, explicit, and legitimate purposes: Processing purposes are defined clearly and lawfully.
Relevance, limitation, and proportionality: Only data necessary for the purpose is processed.
Retention for necessary periods: Data is stored only for the duration required by law or processing purposes.

Conditions for Processing Personal Data

Personal data may be processed without the explicit consent of the data subject only if one of the legal conditions specified in Article 5 of the PDPL is met.

Cases Where Explicit Consent Is Not Required:

Processing is clearly provided for by law
The data subject is unable to express consent due to physical impossibility
Processing is necessary for establishing or performing a contract
Processing is mandatory for the Company to fulfill its legal obligations
The data subject has made the data publicly available
Processing is necessary for the establishment, exercise, or protection of a right
Processing is necessary for the legitimate interests of the Company, provided rights and freedoms are not violated

Transfer of Personal Data

Personal data may be transferred, with necessary security measures in place, to the following parties:

Legally authorized public institutions and organizations
Company shareholders/partners
Suppliers
Authorized private legal entities

Processing of Special Categories of Personal Data

Special categories of personal data are processed with heightened security measures and in accordance with the methods determined by the Personal Data Protection Board.

Except for health and sexual life data, special categories of personal data may be processed without explicit consent only if clearly provided for by law; otherwise, explicit consent is required.

Health data may be processed without consent for protecting public health, medical diagnosis, treatment, and healthcare services by persons under confidentiality obligations.

Categories and Purposes of Personal Data Processed

The personal data categories processed by our Company are listed in Annex–1 (“Personal Data Categories”). Processing purposes are detailed in Annex–2 (“Personal Data Processing Purposes”).

Special Cases of Personal Data Processing

Camera Surveillance

For security purposes, camera recordings are conducted in Company facilities. Data subjects are informed through visible notices.

Internet Access Logs

Internet access provided to visitors is logged in compliance with Law No. 5651 and retained securely.

Measures for the Protection of Personal Data

Technical Measures

Our Company implements technical safeguards to prevent unlawful access, loss, or misuse of personal data.

Administrative Measures

A Personal Data Protection Committee has been established; awareness training is provided; procedures and internal regulations are maintained for compliance.

Protection of Special Categories of Personal Data

Special categories of data are subject to stricter controls and periodic audits.

Deletion, Destruction, or Anonymization of Personal Data

Personal data is deleted, destroyed, or anonymized when the processing purpose no longer exists or upon request of the data subject, in accordance with the Company's Personal Data Retention and Destruction Policy.

Rights of the Data Subject

To learn whether personal data is processed
To request information if data is processed
To learn processing purpose and whether it is used accordingly
To learn recipients of transferred personal data
To request correction of incomplete or inaccurate data
To request deletion or destruction of personal data
To object to decisions made exclusively through automated processing
To request compensation for damages caused by unlawful processing

Exercising Data Subject Rights

Requests concerning the rights listed above may be submitted by completing the application form available on the Company’s website.

Response to Applications

The Company evaluates and responds to applications within 30 days. Applications are free of charge unless they require additional cost.

Data Controller Information

Atlas Trafo A.Ş.
Address: Pancar OSB 5. Cadde No:3 Torbalı / İzmir
E-mail: kvkk@atlastrafo.com

{"id":145,"page_id":73,"lang_id":37,"title":"Personal Data Processing and Protection Policy","short_text":null,"text":"<h2>Personal Data Processing and Protection Policy<\/h2>\r\n\r\n<h3>Introduction, Scope, and Definitions<\/h3>\r\n\r\n<p>The Personal Data Protection Law No. 6698 (“PDPL”) entered into force on 07.04.2016 and regulates the protection of individuals’ personal data comprehensively. This Personal Data Processing and Protection Policy (“Policy”) has been prepared by Atlas Trafo A.\u015e. (“Company\/Our Company”) to outline how the Company implements the rules specified by the PDPL and relevant legislation.<\/p>\r\n\r\n<p>Our Company performs necessary internal arrangements for compliance with this Policy and ensures continuity by maintaining internal audit mechanisms.<\/p>\r\n\r\n<h4>Scope<\/h4>\r\n\r\n<p>This Policy covers all personal data processed by our Company—whether automatically or non-automatically—belonging to employees, former employees, employee candidates, interns, group employees, employee relatives, shareholders\/partners, company officials, customers, potential customers, visitors, supplier employees, and supplier representatives, as defined in section 1.3 of the Policy.<\/p>\r\n\r\n<h4>Definitions<\/h4>\r\n\r\n<p>Definitions not included in this Policy shall bear the meanings specified in the PDPL and secondary legislation.<\/p>\r\n\r\n<h3>Principles for Personal Data Processing<\/h3>\r\n\r\n<p>Our Company processes personal data in accordance with the following fundamental principles:<\/p>\r\n\r\n<ul>\r\n\t<li><strong>Lawfulness and fairness:<\/strong> All personal data processing activities comply with applicable laws.<\/li>\r\n\t<li><strong>Accuracy and up-to-dateness:<\/strong> Personal data is kept accurate and updated as necessary.<\/li>\r\n\t<li><strong>Specified, explicit, and legitimate purposes:<\/strong> Processing purposes are defined clearly and lawfully.<\/li>\r\n\t<li><strong>Relevance, limitation, and proportionality:<\/strong> Only data necessary for the purpose is processed.<\/li>\r\n\t<li><strong>Retention for necessary periods:<\/strong> Data is stored only for the duration required by law or processing purposes.<\/li>\r\n<\/ul>\r\n\r\n<h3>Conditions for Processing Personal Data<\/h3>\r\n\r\n<p>Personal data may be processed without the explicit consent of the data subject only if one of the legal conditions specified in Article 5 of the PDPL is met.<\/p>\r\n\r\n<h4>Cases Where Explicit Consent Is Not Required:<\/h4>\r\n\r\n<ul>\r\n\t<li>Processing is clearly provided for by law<\/li>\r\n\t<li>The data subject is unable to express consent due to physical impossibility<\/li>\r\n\t<li>Processing is necessary for establishing or performing a contract<\/li>\r\n\t<li>Processing is mandatory for the Company to fulfill its legal obligations<\/li>\r\n\t<li>The data subject has made the data publicly available<\/li>\r\n\t<li>Processing is necessary for the establishment, exercise, or protection of a right<\/li>\r\n\t<li>Processing is necessary for the legitimate interests of the Company, provided rights and freedoms are not violated<\/li>\r\n<\/ul>\r\n\r\n<h3>Transfer of Personal Data<\/h3>\r\n\r\n<p>Personal data may be transferred, with necessary security measures in place, to the following parties:<\/p>\r\n\r\n<ul>\r\n\t<li>Legally authorized public institutions and organizations<\/li>\r\n\t<li>Company shareholders\/partners<\/li>\r\n\t<li>Suppliers<\/li>\r\n\t<li>Authorized private legal entities<\/li>\r\n<\/ul>\r\n\r\n<h3>Processing of Special Categories of Personal Data<\/h3>\r\n\r\n<p>Special categories of personal data are processed with heightened security measures and in accordance with the methods determined by the Personal Data Protection Board.<\/p>\r\n\r\n<p>Except for health and sexual life data, special categories of personal data may be processed without explicit consent only if clearly provided for by law; otherwise, explicit consent is required.<\/p>\r\n\r\n<p>Health data may be processed without consent for protecting public health, medical diagnosis, treatment, and healthcare services by persons under confidentiality obligations.<\/p>\r\n\r\n<h3>Categories and Purposes of Personal Data Processed<\/h3>\r\n\r\n<p>The personal data categories processed by our Company are listed in Annex–1 (“Personal Data Categories”). Processing purposes are detailed in Annex–2 (“Personal Data Processing Purposes”).<\/p>\r\n\r\n<h3>Special Cases of Personal Data Processing<\/h3>\r\n\r\n<h4>Camera Surveillance<\/h4>\r\n\r\n<p>For security purposes, camera recordings are conducted in Company facilities. Data subjects are informed through visible notices.<\/p>\r\n\r\n<h4>Internet Access Logs<\/h4>\r\n\r\n<p>Internet access provided to visitors is logged in compliance with Law No. 5651 and retained securely.<\/p>\r\n\r\n<h3>Measures for the Protection of Personal Data<\/h3>\r\n\r\n<h4>Technical Measures<\/h4>\r\n\r\n<p>Our Company implements technical safeguards to prevent unlawful access, loss, or misuse of personal data.<\/p>\r\n\r\n<h4>Administrative Measures<\/h4>\r\n\r\n<p>A Personal Data Protection Committee has been established; awareness training is provided; procedures and internal regulations are maintained for compliance.<\/p>\r\n\r\n<h4>Protection of Special Categories of Personal Data<\/h4>\r\n\r\n<p>Special categories of data are subject to stricter controls and periodic audits.<\/p>\r\n\r\n<h3>Deletion, Destruction, or Anonymization of Personal Data<\/h3>\r\n\r\n<p>Personal data is deleted, destroyed, or anonymized when the processing purpose no longer exists or upon request of the data subject, in accordance with the Company's Personal Data Retention and Destruction Policy.<\/p>\r\n\r\n<h3>Rights of the Data Subject<\/h3>\r\n\r\n<ul>\r\n\t<li>To learn whether personal data is processed<\/li>\r\n\t<li>To request information if data is processed<\/li>\r\n\t<li>To learn processing purpose and whether it is used accordingly<\/li>\r\n\t<li>To learn recipients of transferred personal data<\/li>\r\n\t<li>To request correction of incomplete or inaccurate data<\/li>\r\n\t<li>To request deletion or destruction of personal data<\/li>\r\n\t<li>To object to decisions made exclusively through automated processing<\/li>\r\n\t<li>To request compensation for damages caused by unlawful processing<\/li>\r\n<\/ul>\r\n\r\n<h3>Exercising Data Subject Rights<\/h3>\r\n\r\n<p>Requests concerning the rights listed above may be submitted by completing the application form available on the Company’s website.<\/p>\r\n\r\n<h3>Response to Applications<\/h3>\r\n\r\n<p>The Company evaluates and responds to applications within 30 days. Applications are free of charge unless they require additional cost.<\/p>\r\n\r\n<h3>Data Controller Information<\/h3>\r\n\r\n<p><strong>Atlas Trafo A.\u015e.<\/strong><br \/>\r\nAddress: Pancar OSB 5. Cadde No:3 Torbal\u0131 \/ \u0130zmir<br \/>\r\nE-mail: kvkk@atlastrafo.com<\/p>","service_text":null,"link":"personal-data-processing-and-protection-policy-73","otherlink":null,"meta_title":null,"meta_description":null,"meta_keywords":null,"created_at":"2025-12-04T13:51:03.000000Z","updated_at":"2025-12-04T13:51:03.000000Z"}