Employee Privacy Notice

This English version is a translation provided for convenience. The original notice is in Turkish.

INFORMATION NOTICE ON THE PROCESSING OF EMPLOYEES' PERSONAL DATA

1. PURPOSE, SCOPE AND DATA CONTROLLER

As ARTEA DIŞ TİC. MAK. SAN. LTD. ŞTİ. ("AXTEA" or the "Company"), we attach importance to the privacy and security of our employees' personal data.

Within the scope of the Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, we process your personal data in our capacity as data controller, in accordance with the law and the rules of good faith, for specific, explicit and legitimate purposes, and in a manner that is relevant, limited and proportionate to the purposes for which it is processed.

This information notice has been prepared to inform personnel working within our Company about the purposes for which their personal data is processed, the legal grounds relied on, the parties to whom it may be transferred, and the rights of the persons concerned.

DATA CONTROLLER

ARTEA DIŞ TİC. MAK. SAN. LTD. ŞTİ.

Address: Büyükbalıklı Mahallesi, 1. Ayça Sokak, No: 6, 16250 Nilüfer / Bursa, Türkiye
Phone: +90 224 440 01 90
Mersis Number: 0085145117100001
Registered Email (KEP) Address: artea@hs03.kep.tr
Email: info@axteasolutions.com
Website: www.axteasolutions.com

2. PERSONAL DATA PROCESSED

The following personal data may be processed by our Company in line with employees' duties and the requirements of the relevant processes.

Identity Information: Name, surname, Turkish ID number, date of birth, identity document details and other identifying information you share.
Contact Information: Residential address, email address, telephone number, emergency contact details and other contact information you provide.
Personnel File Information: Employment start and end dates, employment contract, duty and position information, length of service, leave and absence records, work schedules, social security (SGK) information and other personnel records required to be kept under the legislation.
Professional and Corporate Information: Diplomas, professional qualification documents, certificates, vocational training records, work experience and competency documents obtained within the scope of the job.
Financial Information: Bank account details, salary, bonuses, fringe benefits, payment and payroll information, statutory deductions and enforcement records.
Work and Performance Information: Task assignments, evaluations of work processes, targets, work results and performance records relating to the conduct of the work.
Transaction Security Information: Corporate system access records, user accounts, session and license information, and technical records kept for information security purposes.
Health Information: Pre-employment and periodic medical examination records, fitness-for-work assessments, occupational accident records, and records legally required to be kept under occupational health and safety legislation.
Physical Premises Security Information: Recordings taken by workplace security cameras and images taken at events held at certain intervals.
Travel Information: Reservation, transportation, accommodation, passport and required visa information within the scope of business trips.

Data in this category is processed only to the extent legally required and necessary for the relevant activity.

3. PURPOSES OF PROCESSING PERSONAL DATA

The personal data collected is processed for the following purposes.

Employment Contract and Personnel File Procedures: Identity, contact and personnel data is processed to establish and perform employment contracts, create personnel files and carry out procedures for employees joining and leaving the Company.
Salary, Payroll and Social Security Procedures: Identity, personnel and financial data is processed to calculate and pay salaries, prepare payrolls, make tax and social security notifications and provide fringe benefits.
Human Resources and Work Organization: Personnel, professional experience, training and work information is processed to assign tasks, manage work and leave processes, carry out work organization, assess professional competencies and plan necessary training.
Occupational Health and Safety: Identity, personnel and health data required within the scope of occupational health and safety is processed to assess fitness for work, carry out statutory health surveillance, report occupational accidents and fulfill occupational health and safety obligations.
Information Security: Information and transaction security data is processed to create corporate user accounts, manage authorizations, ensure the security of the Company's information systems, prevent unauthorized access and examine technical incidents.
Physical Premises Security: Camera images and necessary entry and exit records are processed to ensure the security of employees, visitors, the workplace and Company assets, prevent unauthorized entry and examine security incidents.
Legal Processes and Official Obligations: Relevant personal data is processed to make statutory notifications to competent public authorities, carry out audits, and exercise rights of defense and claim in legal disputes.

4. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed on the basis of those processing conditions set out in Article 5 of the KVKK that are appropriate to the relevant activity.

KVKK Article 5/2(a): It is expressly provided for by law.
KVKK Article 5/2(c): It is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of that contract, for carrying out contractual and pre-contractual processes.
KVKK Article 5/2(ç): Processing is mandatory for the data controller to fulfill its legal obligations.
KVKK Article 5/2(e): Processing is mandatory for the establishment, exercise or protection of a right.
KVKK Article 5/2(f): Processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
KVKK Article 6/3(f): Processing is mandatory for fulfilling legal obligations in the fields of employment, occupational health and safety, and social security.

Health information is a special category of personal data. Access to this data is limited to authorized persons who need it for their duties.

5. METHODS OF COLLECTING PERSONAL DATA

As the data controller, our Company obtains your personal data through documents and information you provide during employment and personnel procedures, employment contracts and personnel forms, human resources and accounting records, corporate information systems, email and work communication tools, records obtained from the Social Security Institution (SGK) and other competent authorities in accordance with the legislation, and records and information obtained through entry and exit systems and security cameras.

Your data may be processed by fully or partially automated means, or by non-automated means provided that they form part of a data recording system.

6. TRANSFER OF PERSONAL DATA

Employees' data may be transferred to the following groups of recipients, limited to the relevant processing purposes and subject to the conditions in Article 8 of the KVKK.

Competent Public Institutions and Organizations: To the Social Security Institution, tax offices, relevant ministries, courts and other competent authorities in order to fulfill obligations arising from the legislation.
Banks and Financial Institutions: In order to make salary, fringe benefit and other payments within the scope of the employment relationship.
Occupational Health and Safety Service Providers: In order to carry out occupational health and safety services and the necessary health surveillance, limited to the duties and authorizations of the persons concerned.
Accounting and Payroll Service Providers: In order to carry out tax, payroll, salary and statutory notification processes.
Information Technology Service Providers: In order to provide corporate software, data hosting and information security services.
Travel Service Providers: In order to carry out transportation, accommodation and visa procedures for business trips.

Transfers are limited to the data necessary for the relevant activity.

Your personal data may be transferred to the AXTEA affiliate company and to servers located abroad of the information and communication systems we use, subject to the general principles of the Law, our processing purposes and the appropriate condition in Article 9 of the Law on the transfer of data abroad. If personal data is to be transferred abroad on the basis of your explicit consent, the transfer will be carried out after your explicit consent is obtained.

7. RETENTION AND DESTRUCTION OF PERSONAL DATA

Your personal data is retained for the period required by the purposes of processing and in accordance with the retention periods set out in the relevant legislation.

For personnel files, payroll and social security records, occupational health and safety documents, health records and information security records, the retention periods applicable to the relevant type of record are taken as the basis.

Where the reasons requiring processing no longer exist and there is no other legal retention obligation, your personal data is deleted, destroyed or anonymized in accordance with the KVKK and the relevant legislation.

The termination of your employment contract with our Company does not mean that personal data required by law to be retained will be deleted immediately.

8. SECURITY OF PERSONAL DATA

Our Company applies appropriate technical and administrative measures to prevent unlawful processing of personal data and unauthorized access, loss or disclosure. Access to employees' personal data is limited in line with the requirements of duties and authorizations.

Additional security measures are applied for the protection of special categories of personal data.

9. RIGHTS OF EMPLOYEES

Under Article 11 of the KVKK, you may learn whether your personal data is processed, request information if it has been processed, learn the purpose of processing and whether it is used in accordance with that purpose, know the third parties to whom it is transferred, request the correction or deletion of your data under the conditions set out in the legislation, and exercise your other legal rights.

You may submit your requests in this regard to our Company by the methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Application Address: Büyükbalıklı Mahallesi, 1. Ayça Sokak, No: 6, 16250 Nilüfer / Bursa, Türkiye
Email: info@axteasolutions.com

KVKK applications made by email must comply with the procedures set out in the Communiqué.

Your applications are concluded in accordance with the relevant legislation as soon as possible, depending on the nature of your request, and within 30 days at the latest.

Yours sincerely,