Contact Information

Kişisel Verilerin İşlenmesine İlişkin Aydınlatma Metnini okudum ve Kişisel verilerimin ürün ve hizmetlerinizi geliştirmek, pazarlama faaliyetlerinizi yürütmek, kampanyalarınız hakkında bilgi vermek, reklam, promosyon vb. ticari elektronik ileti göndermek, pazarlama analizleri yapabilmek, ürünlerinizi kişiselleştirebilmek amaçları ile işlenmesini ve bu iletilerin gönderimini sağlamak üzere Özak Global Holding A.Ş., Özak Gayrimenkul Yatırım Ortaklığı A.Ş., Aktay Otel İşletmeleri A.Ş., Akyön Tesis Yönetim Hizmetleri A.Ş., Kamer İnşaat Ticaret ve Sanayi A.Ş., Akyön Özel Güvenlik ve Koruma Hizmetleri A.Ş., İnt-Er Yapı İnşaat Turizm San. ve Tic. A.Ş., Özak Tekstil Konfeksiyon San. ve Tic. A.Ş., Kübrateks Tekstil San ve Dış. Tic. A.Ş., Özak Yenigün Ziylan Adi Ortaklığı ile iştirakleriniz, bağlantılı şirketleriniz, ticari iş ortaklarınız ve hizmet aldığınız şirketler ile paylaşılmasını kabul ediyorum.

Bu aydınlatma metni, 6698 sayılı Kişisel Verilerin Korunması Kanununun (“Kanun”) 10 uncu maddesi ile Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ kapsamında veri sorumlusu olarak Özak Global Holding Anonim Şirketi (“Şirket”) tarafından hazırlanmıştır. Şirket tarafından Kişisel verileriniz Kanun uyarınca aşağıda açıklanan kapsamda işlenebilecektir.

Kişisel verilerinizin işlenme amaçları konusunda detaylı bilgilere www.ozakglobal.com adresinden Kişisel Verilerin Korunması ve İşlenmesi Politikası’ ndan ulaşabilirsiniz.

Hangi Kişisel Verilerinizi İşliyoruz?

Ad, soyad, cep telefonu, ev telefonu, elektronik posta adresi, doğum tarihi, çalışılan şirket ismi, kimlik bilgileri ve tarafımız ile paylaştığınız diğer her türlü Kişisel Veriler.

Kişisel Verileriniz İşlenme Amaçları ve Hukuki Sebepleri Nelerdir?

Kişisel verileriniz verdiğimiz hizmetleri sözleşmenin ve teknolojinin gereklerine uygun şekilde yerine getirmek, ürün ve hizmetlere ilişkin satış sonrası destek hizmetlerini sunmak, müşteri ilişkileri süreçlerimizi yürütmek, talep ve şikâyetlerinizi karşılayabilmek, Şirketimiz tarafından yürütülen ticari faaliyetlerin gerçekleştirilmesi için ilgili iş birimlerimiz tarafından gerekli çalışmaları yapmak ve buna bağlı iş süreçlerini yürütmek amaçları ile Kanun’un 5. ve 6. maddelerinde belirtilen kişisel veri işleme şartları kapsamında işlenecektir.

Açık rızanıza dayalı olarak ise ürün ve hizmetlerimizi geliştirmek, pazarlama faaliyetlerimizi yürütmek, kampanyalarımız hakkında sizleri bilgilendirmek, reklam, promosyon vb. ticari elektronik ileti göndermek ve bu iletilerin gönderimini sağlamak üzere hizmet aldığımız şirketler ile paylaşmak, sizleri daha iyi tanıyarak ihtiyaçlarınız doğrultusunda doğru hizmeti vermek, hizmetlerimiz esnasında çekilen fotoğraflarınızı kullanmak, pazarlama analizleri yapabilmek, ürünlerimizi talepleriniz doğrultusunda kişiselleştirebilmek profilleme yapmak amaçları ile verileriniz işlenebilecektir.

Kişisel Verileriniz Kimlere Hangi Amaçlarla Aktarılabilir?

Toplanan kişisel verileriniz; yukarıda belirtilen amaçların gerçekleştirilmesi doğrultusunda grup şirketlerimiz olan Özak Gayrimenkul Yatırım Ortaklığı A.Ş., Yenigün İnşaat Sanayi ve Ticaret A.Ş., Ziylan Gayrimenkul Yatırım ve Yönetim A.Ş., Aktay Otel İşletmeleri A.Ş., Akyön Tesis Yönetimi A.Ş., Kamer İnşaat Ticaret ve Sanayii A.Ş., Akyön Özel Güvenlik ve Koruma Hizmetleri A.Ş., İnt-Er Yapı İnşaat Turizm San. ve Tic. A.Ş., Özak Yenigün Ziylan Adi Ortaklığı, Özak Tekstil Konfeksiyon San. ve Tic. A.Ş., Kübrateks Tekstil San. ve Dış. Tic. A.Ş., olmak üzere ana hissedarlarımıza, bağlantılı şirketlerimize, grup şirketlerimize, iştiraklerimize, size verdiğimiz hizmeti yerine getirmek üzere destek aldığımız servis sağlayıcı firmalara, iş ortaklarımıza, bayilerimize, tedarikçilerimize, kanunen yetkili kamu kurumlarına, hizmet aldığımız kuruluşlar, kullandığımız yurt içi ve yurt dışı server (sunucular), bulut hizmeti aldığımız yurt içi/yurt dışı kurumlar, veri sorumlusu adına veri işleyen, ölçümleme, hedefleme, profilleme desteği veren kişi ve kuruluşlar, denetim şirketleri, reklam ve tanıtım ajansları ve özel kişilere Kanun’un 8. ve 9. maddelerinde belirtilen kişisel veri işleme şartları çerçevesinde aktarılabilecektir.

Verileriniz yurt içi/yurtdışında bulunan serverlara, bulut hizmeti aldığımız yurtiçi/yurtdışı kurumlara Kanun’ un 9. Maddesi gereği açık rızanız doğrultusunda aktarılabilecektir.

Kişisel Verilerinizin Toplanma Yöntemi ve Hukuki Sebebi Nedir?

Kişisel verileriniz Şirketimiz ile temas edeceğiniz; elektronik ortamda internet sitesi, çağrı merkezi, çevrim içi uygulamalar, çerezler, elektronik postalar, sosyal medya kanalları, arama motorları ve fiziki ortamda bayi kanalı, satış ve pazarlama departmanları çalışanlarımız, basılı formlar, üyelik formları ve çözüm ortaklarımız aracılığı ile sözleşmenin ifası hukuki sebebine dayalı olarak toplanacaktır.

Açık rıza vermeniz halinde ise ürün ve hizmetlerimizin beğeni ve kullanım alışkanlıklarınıza göre özelleştirilerek size sunulması hukuki sebebine dayalı olarak Kanun’un 5. ve 6. maddelerinde belirtilen kişisel veri işleme şartları kapsamında işlenebilmektedir.

Kişisel Veri Sahibi Olarak Haklarınız Nelerdir?
Kişisel veri sahibi olarak Kanun’un 11. maddesi uyarınca aşağıdaki haklara sahip olduğunuzu bildiririz:

a) Kişisel veri işlenip işlenmediğini öğrenme,
b) Kişisel verileri işlenmişse buna ilişkin bilgi talep etme,
c) Kişisel verilerin işlenme amacını ve bunların amacına uygun kullanılıp kullanılmadığını öğrenme,
ç) Yurt içinde veya yurt dışında kişisel verilerin aktarıldığı üçüncü kişileri bilme,
d) Kişisel verilerin eksik veya yanlış işlenmiş olması hâlinde bunların düzeltilmesini isteme,
e) 7 inci madde de öngörülen şartlar çerçevesinde kişisel verileri silinmesini veya yok edilmesini isteme,
f) (d) ve (e) bentleri uyarınca yapılan işlemlerin, kişisel verilerin aktarıldığı üçüncü kişilere bildirilmesini isteme,
g) İşlenen verilerin münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle kişinin kendisi aleyhine bir sonucun ortaya çıkmasına itiraz etme,
ğ) Kişisel verilerin kanuna aykırı olarak işlenmesi sebebiyle zarara uğraması hâlinde zararın giderilmesini talep etme.

Yukarıda yer alan haklarınıza ilişkin başvurularınızı, www.ozakglobal.com adresinde yer alan Başvuru Formu’ nu doldurduktan sonra kimliğiniz ile şahsen şirket merkezimize gelerek, noter vasıtası ile, güvenli elektronik imzanız ile imzalayıp şirket kayıtlı elektronik posta adresine elektronik posta göndererek veya tarafınızca daha önce bildirilen ve sistemimizde kayıt altına alınmış olan elektronik posta adresiniz üzerinden elektronik posta göndermek suretiyle yapabilirsiniz. Talebinizin niteliğine göre en kısa sürede ve en geç otuz gün içinde başvurularınız ücretsiz olarak sonuçlandırılacaktır; ancak işlemin ayrıca bir maliyet gerektirmesi halinde Kişisel Verileri Koruma Kurulu tarafından belirlenecek tarifeye göre tarafınızdan ücret talep edilebilecektir. İletişim bilgilerimiz aşağıda yer almaktadır:

Elektronik Posta Adresi: kvkk@ozakglobal.com

Kayıtlı Elektronik Posta Adresi: ozakglobal@hs01.kep.tr

Posta adresi: İkitelli OSB Mah. 10 Cad. 34 Portal Plaza No:7D/16 Başakşehir/İSTANBUL

1. Chapter 1 - Introduction

1.1. Introduction

The protection of personal data is among the top priorities of our company. The most important pillar of this issue is, by governing this policy, the protection and processing of the personal data of our customers, potential customers, candidate employees, company shareholders, company officials, visitors, as well as employees, shareholders and authorities of the institutions we cooperate, and third parties.

This policy sets out the principles to be adopted and considered in terms of implementation by Özak Global Holding Şirketleri regarding the processing and protection of personal data. This policy determines the functions to be fulfilled by Özak Global Şirketleri and sets out the basic principles on how to comply with the regulations stipulated in the Law on the Protection of Personal Data No. 6698 (KVKK). In this sense, the administrative and technical measures to be taken by Özak Global Holding Şirketleri are examined to protect personal data processed in compliance with the relevant legislation.

1.2. Purpose of the Policy

The main purpose of this policy is to provide information on the personal data processing activities conducted in accordance with the law by Özak Global Holding Şirketleri, and on the systems adopted for the protection of personal data. In this context, our aim is to ensure transparency by informing people, notably our customers, potential customers, candidate employees, company shareholders, company officials, visitors, as well as employees, shareholders and authorities of the institutions we cooperate, and third parties, whose personal data are processed by Özak Global Holding Şirketleri.

1.3. Scope of the Policy

This policy relates to all personal data of our customers, potential customers, candidate employees, Company shareholders, Company officials, visitors, as well as employees, shareholders and authorities of the institutions we cooperate, and third parties, processed through automated means or provided that they are part of any data registry system through non-automated means.

This Policy may be amended from time to time by the approval of the Board of Directors, if stipulated by the KVK Regulations or when deemed necessary by the Company's Data Controller.

1.4. Entry into Force of The Policy

The Policy, developed by our company, will be updated in the event of a renewal of the entire or certain provisions.

The policy is published on our Company's website and made available to the relevant persons upon request of the personal data subjects.

1.5. Definitions

Explicit Consent: Consent about a specific subject based on the information and expressed in free will.
Anonymization: The modification of personal data in such a way that they lose their personal data feature and that this condition cannot be recovered. For instance, making personal data unassociated with a real person with techniques of masking, consolidation, data destruction, etc.
Candidate Employee: Real persons who have applied for a job in any way to our Company or have opened their background and related information for inspection by our Company.
Employees, Shareholders, and Authorities of the Institutions we Cooperate: Real persons, including shareholders and authorities of the institutions, who work in these institutions (including, but not limited to as a business partner, supplier, etc.) with which we have developed any kind of business relation.
Personal Data Subject: Real person whose data are processed. For example; Customers and employees.
Personal Data: Any information related to the identified or identifiable real person. The processing of data relating to legal persons is hereby not within the scope of the Law. For instance; name-surname, TR identity number, e-mail, address, date of birth, credit card number, etc.
Customer: Real persons who used or have been using the products and services offered by our company.
These data are the personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data.
Potential Customer: Real persons who have the potential to do business with our company, who might want to work, who have purchasing power, but we have not reached yet, and whom we have not sold anything even if reached.
Company Shareholders: Real persons who are shareholders of our company.
Company Authority: Executive board members of our company and other authorized real persons.
Data Processor: A real and legal person who processes personal data on his behalf on the basis of the authority conferred by the data controller.
Visitor: Real persons who have entered our physical premises with various purposes or visited our websites.

2. Chapter 2 - Protection of Personal Data

Our Company, in accordance with Article 12 of the Law on KVK, takes the necessary technical and administrative measures to ensure that the appropriate level of security is maintained so as to prevent illegal processing of personal data, to prevent illegal access to data, as well as to ensure data retention; within this scope, it performs required inspections or has these inspections done.

2.1. Ensuring Security of Personal Data

2.1.1. Technical and Administrative Measures for Legal Processing and Protection of Personal Data

Our Company takes technical and administrative measures considering technological facilities and application cost so as to ensure that personal data is processed in accordance with the law; to prevent indiscreet or unauthorized disclosure, access, transfer, or other unlawful access of personal data; to prevent them from being stored in unsecure environment and being illegally destroyed, lost or altered.

• All processes related to data processing activities within Özak Global Holding Şirketleri are analyzed on the basis of business units. In this context, a "personal data processing map" was issued.
• Pursuant to the personal data processing map, the works to be performed in order to ensure compliance with the law is identified on a unit basis.
• The developed personal data processing processes are inspected by the technical systems to be devised and reported to the concerned party.
• Özak Global Holding Şirketi employees were informed about the legal processing of personal data and sanctions for unlawful data processing.
• Regular inspections are carried out to ensure awareness of the employees. Required administrative measures are implemented through the internal policies and training of Özak Global Holding Şirketleri.
• Özak Global Holding Şirketleri makes entries regarding the confidentiality of shared personal data and how they should be processed and stored, in contracts and documents governing the legal relationship among the Company, its employees, subsidiaries, business partners, suppliers, and customers.
• Access to personal data is limited to the employees assigned to data processing. Employees are restricted from accessing personal data that they do not use as a requirement for their tasks.
• Technical personnel is employed for technical matters.
• Technological technical measures have been taken to prevent access to systems and locations where personal data are stored, and these measures are periodically updated.
• Access and authorization technical processes were designed and activated by Özak Global Holding Şirketleri, in accordance with business unit-based legal compliance requirements.
• The technical measures taken are periodically reported to the concerned parties.
• Required software and systems, including virus protection systems and firewalls, are installed.
• Özak Global Holding Şirketleri employees are trained in the technical measures taken in this sense, and technical personnel is employed.
• The employees of Aktay Otel İşletmeleri A.Ş. are committed not to disclose the personal data they acquired to others in violation of the provisions of KVKK, and not to use them other than for data processing. This commitment shall continue to effect even after they have left the job.
• To protect personal data, the provisions for the required security measures were inserted to the contracts in which Özak Global Holding Şirketleri concluded with people to whom personal data are transferred.
• Technological systems are being used in order to store personal data in a secure environment.
• Technical personnel are employed for technical matters.
• Technical security systems are established for fixed storage, and technical measures taken are periodically reported to the concerned in pursuant to internal audit mechanism, and the required technological solution is produced by reevaluating the risk issues.
• To ensure the safe storage of personal data, backup programs are used in a lawful manner.
• Employees are trained to ensure the safe storage of personal data.
• In case of getting an external service [outsourcing] due to technical requirements for the storage of personal data, provisions concerning that the persons to whom personal data is transferred will take necessary security measures for data protection, and these measures are complied within their institutions, are inserted to the contracts concluded with the companies which personal data are legally transferred to.

2.1.2. Audit of Measures Taken on Personal Data Protection

Our Company performs the required audits within its own body in accordance with Article 12 of the Law on KVK. The results of these audits are reported to the concerned department in line with the Company's internal operation procedures, and required activities are carried out to improve the measures taken.

2.1.3. Measures to be Taken in Case of Unauthorized Disclosure of Personal Data

In case that others obtain personal data processed in accordance with Article 12 of the Law on KVK through illegal means, our company operates a system that allows this situation to be notified to the concerned personal data subject and the KVK Board as soon as possible.

If deemed necessary by the KVK Board, this may be announced on the website of the KVK Board or by any other means.

2.2. Observing the Rights of Data Subject and Evaluating the Complaints

Our Company exploits required channels, internal working procedures, administrative and technical regulations in accordance with Article 13 of the Law on KVK to evaluate the rights [and complaints] of personal data subjects and to provide them with necessary information.

In the event that personal data subjects submit their complaints in writing to our Company regarding their rights stipulated in the Law on KVK, our company concludes the complaint as soon as possible and free of charge within 30 days at the latest depending on the nature of the complaint. However, if the process requires an additional cost, our Company will charge the tariff determined by the KVK Board.

The data controller accepts or rejects the complaint and notifies the concerned in writing or electronically. In case the complaint mentioned in the application is found acceptable, the data controller does the necessary. In the event that the application is made due to a mistake of the data controller, the fee shall be returned to the person concerned.

3. Chapter 3- Processing of Personal Data

In accordance with Article 4 of the Law on KVK, Özak Global Şirketleri conducts data processing activities in compliance with the law and good faith.

Our Company retains personal data as long as required by law or as required for personal data processing purposes.

Özak Global Holding Şirketleri processes personal data on the basis of certain requirements of Article 5 of the Law on KVK about personal data processing.

Özak Global Holding Şirketleri elucidates personal data subjects and informs them when requested information in accordance with Article 10 of the Law on KVK.

Özak Global Holding Şirketleri complies with the regulations envisaged for the processing of data of special nature, pursuant to the provisions of Article 6 of the Law on KVK. In accordance with Articles 8 and 9 of the Law on KVK, Özak Global Holding Şirketleri complies with the regulations stipulated by the Law and set forth by the KVK Board on the transfer of personal data.

3.1. Processing of Personal Data Pursuant to the Principles Prescribed in Legislation

3.1.1. Processing compliance with the Rule of Law and Good Faith

Özak Global Holding Şirketleri acts in accordance with the principles set out by legal regulations and general trust and good faith in the processing of personal data. In this context, our Company takes into consideration the proportionality requirements in the processing of personal data and does not use personal data other than for its intended purpose.

3.1.2. Ensuring Personal Data Accuracy, and Up-to-Dateness Where Necessary

Özak Global Holding Şirketleri ensures that processed personal data are accurate and up-to-date, taking into account the fundamental rights of personal data subjects and their legitimate interests. In this respect, our company takes the necessary measures.

3.1.3. Being processed for specific, explicit and legitimate purposes

Özak Global Holding Şirketleri processes personal data for specific, explicit and legal reasons. Özak Global Holding Şirketleri should identify the purpose for which personal data will be processed, and should provide data subjects with this purpose before their personal data is processed. Personal data should not be processed for the purposes other than those specified. The purposes of data processing identified by Özak Global Holding Şirketleri shall be legitimate and lawful.

3.1.4. Being relevant to, limited to, and proportionate to the purposes for which they are processed.

Özak Global Holding Şirketleri processes personal data in a way to achieve the identified purposes and avoids the processing of personal data that is not required or not related to the realization of the purpose. For example, our company is not conducting personal data processing to meet probable needs.

3.1.5. Retaining Personal Data for the Period Required for the Purpose stipulated in the Legislation or for the Purpose for Which They were Processed

Özak Global Holding Şirketleri retains personal data only for the period specified in the relevant legislation or for the purpose for which they were processed. In this context, our company determines whether a period has been stipulated for the storage of personal data in the relevant legislation; if this is the case, it takes into account this period; otherwise, it retains personal data for the time period required for the purpose for which they were processed.

3.2. Personal Data Processed by Our Company

3.2.1. Which Personal Data Do We Process

Should you share with us, or if required, your personal data and the data of special nature which may be subject to our processing are as follows:

Name, Surname, Place of birth, Date of birth, Gender, Marital status, Photo, Home Phone Number, Cell Phone Number, Personal e-mail address, Personal Identifying Information, Address, Surveys, Photos conveyed for Form filling and contests, Video recordings, any other personal data you share with us in any way through the channels above, information about your usage of the goods and services we offer, personal data collected automatically by automatic search engines, image and sound recording devices, cookies or other means, social media tools, updated information that our business partners, suppliers, and other third parties share with us based on your prior consent, page display information; information such as search term and search results, and other personal data such as paid listings and sponsored links.

3.2.2. How Your Personal Data Can Be Processed

Pursuant to the Law No. 6698 on the Protection of Personal Data, in Data Controller's capacity, we will be able to process any kind of personal data and data of special nature that you share with our company, by conducting any kinds operation on them, such as retrieving in whole or in part through automated means or provided that they are part of any data registry system, through non-automated means, and registering, storing as long as they required for the processing purpose, preserving, modifying, reorganizing, disclosing, transferring, making acquisition, making retrievable, classifying or preventing of use.

3.3. Elucidating and Informing Personal Data Subject

Our Company elucidates personal data subjects during the retrieving of personal data in accordance with Article 10 of the Law on KVK. In this sense, we provide information on for what purpose personal data will be processed, to whom and for which purpose personal data can be transferred, personal data retrieving method, and legal rights of the personal data subject.

Article 11 of the Law on KVK mentions "request information" as one of the rights of the personal data subject. Our company, pursuant to this provision, provides the necessary information should the personal data subject requests information.

3.4. Purposes of Personal Data Processing

Our company processes personal data in accordance with the terms and conditions specified in the 2nd Subclause of article 5 and 3rd subclause of article 6 of the Law on the Protection of Personal Data numbered 6698. These terms and conditions are as follows:

• The relevant activities of our Company regarding the processing of your personal data should be clearly provided by laws.
• The processing of your personal data by our Company should be directly relevant and necessary for the conclusion or fulfillment of a contract.
• The processing of your personal data should be mandatory for our Company to be able to perform his legal obligations.
• Provided that your personal data is made available to the public by you, the data concerned should be processed in a limited way to this publicization.
• The processing of your personal data by our Company should be mandatory to establish, exercise, or protect the rights of our Company or you or third parties.
• Personal data processing should be mandatory for the legitimate interests of our Company, provided that this processing shall not violate your fundamental rights and freedoms.
• Personal data processing by our company should be mandatory for the protection of life or physical integrity of the personal data subject or of any other person, and in this case, personal data subject should be bodily incapable of giving his consent or whose consent is not deemed legally valid.
• The processing of personal data of special nature, excluding those relating to health and sexual life, is provided for by laws.
• Personal data of special nature of data subject relating to health and sexual life are processed by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

In the absence of these conditions, the Company seeks the explicit consent of the personal data subjects to process personal data.

Under the above conditions, our Company may process personal data for, including but not limited to, the following purposes:

• In line with conducting necessary undertakings by our respective business units and performing related business processes in order to carry out commercial activities by the Company;
  • Planning and implementation of business activities and of ensuring business continuity,
  • Planning and implementation of customs operations, production and/or its operations processes,
  • Business follow-up of finance and/or accounting,
  • Activity method,
  • Providing information with the competent authorities about legislation,
  • Planning and executing corporate communication activities,
  • Planning and implementation of supply chain management and logistics activities,
  • Planning and implementation of production and/or its operation processes
  • Planning and implementation of information access authorities for business partners and/or suppliers
• In line with conducting necessary undertakings by our respective business units and performing related business processes in order to benefit people from products and services offered by the Company;
  • Planning and implementation of customer relationship management processes,
  • Following customer requests and/or complaints,
  • Planning and implementation of marketing processes of products and/or services,
  • Planning and/or implementation of after-sales support services activities,
  • Business follow-up of contract processes and/or legal requests, performing and following the customer's insurance process,
• In line with the aim of carrying out necessary activities in order to offer products and services of our Company to personal data subjects by customizing these product and services according to the subject's taste, usage habits and needs;
  • Planning and implementation of market research activities for the sales and marketing of products and services,
  • Sales and after-sales operations and procurement operations,
  • Planning and/or implementation the processes of creating and/or increasing loyalty to the products and/or services offered by the Company,
• In line with the purpose of ensuring the implementation of our Company's human resources policies;
  • Fulfilling the obligations and taking necessary measures within the framework of occupational health and safety,
  • Evaluation of job applications in accordance with our Company's Human Resources Policies,
  • Fulfilling of the obligations arising from the employment contract and/or legislation for the employees of the Company,
  • Personnel recruitment and layoff procedures,
  • Evaluating of pay for performance process,
  • Managing of wages and payrolls,
  • Planning and/or implementation of internal training activities,
  • Conducting other human resources operations,
• In line with the purpose of ensuring legal and commercial security of our Company and business contacts;
  • Business follow-up of the company's legal affairs,
  • Planning and implementation of the operational activities required to ensure that the Company's activities are carried out in compliance with the Company procedures and/or relevant legislation,
  • Creating and tracking visitor records,
  • Ensuring the security of company premises and/or facilities,
  • Ensuring the security of company inventory stocks and/or resources,
  • Ensuring the security of company operations,
  • Planning and implementation of emergency management processes,
  • Planning and/or implementation of financial risk processes of the Company,
• In line with the purpose of determining and implementing our company's commercial and business strategies;
  • Financial operations performing by our company, communication, market research and social responsibility activities, procurement operations, product/project/manufacturing/investment quality processes and operations,
  • Company internal system and application management operations,
  • Planning and/or implementation of external training activities,
  • Managing of relations with business partners and/or suppliers.

In the case that personal data subject does not give his/her explicit consent, it should be understand that our business units may carry out personal data processing for purposes that do not require explicit consent of the personal data subject, as specified in the first paragraph, and may carry out data processing which remains outside the scope of the same purpose for data processing; rather than that not to carry out any data processing.

3.5. Processing Data of Special Nature

In processing personal data designated as "data of special nature" by the Law on KVK, our Company strictly adheres to the regulations stipulated in the Law.

In Article 6 of the Law on KVK, a set of personal data, when illegally processed, which have the risk of causing unjust suffering or discrimination, are identified as "data of special nature". These data are the personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions, and security measures, and the biometric and genetic data.

3.7.1. Transfer of Personal Data

Our company may transfer personal data, in line with legitimate and legal personal data processing purposes, to third parties on the basis of one or more of the personal data processing conditions specified in Article 5 of the Law listed below:

• Should personal data subject express his/her explicit consent,
• Should there is a clear regulation about the transfer of personal data by law,
• Should the transfer is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his/her consent or whose consent is not deemed legally valid.
• Should the transferring of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfillment of that contract.
• Should personal data transfer is mandatory for our Company to fulfill its legal obligation,
• Should personal data are made available to the public by the data subject himself,
• Should personal data transfer is mandatory for the establishment, exercise, or protection of any right.
• Should it is mandatory for the legitimate interests of our Company, provided that the transfer shall not violate the fundamental rights and freedoms of the data subject.

3.7.2. Transfer of Personal Data of Special Nature

Our company may transfer personal data of special nature of the personal data subject to third parties in the following cases in line with legitimate and legal personal data processing purposes, by showing due diligence, taking required security measures, and adequate measures stipulated by the KVK Board.

• Should personal data subject express his/her explicit consent, or
• Should personal data subject does not express his/her explicit consent;
  • In the cases prescribed by the law, the personal data of special nature of the subject (related to race, ethnic origin, political opinion,philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data), other than his/her health and sexual life,
  • Personal data of special nature of data subject relating to health and sexual life are only processed by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

3.7.3. Use of Website Cookies

Özak Global Holding websites are the sites that use cookies. Cookies; is a file consisting mostly of letters and numbers, being stored in the internet browser or on the hard disk of the device in use by allowing the device to be recognized. Özak Global Holding websites store information collected through cookies, log files, blank gif files, and/or third-party resources to form a summary of your preferences.

We use two types of cookies on our websites; session cookies and persistent cookies. Session cookies are temporary cookies that are valid only until you close your browser. Persistent cookies remain on your hard disk until you delete them or they expire (in this option, how long cookies remain on the device will depend on the lifetime of the cookies).

Websites use cookies to remember your preferences and customize your website/mobile application. This includes cookies that save your user password and allow you to stay your website/mobile application logged continuously in, thus saving you the trouble of entering passwords more than once for each visit, and includes the cookies that remember and recognize you on your next visit to the website/mobile app.

These cookies are used to determine how you use the website/mobile application, and to measure the parameters such as the duration of your visit, including where you connect to the web site, what content you view on the website/mobile app, and how you use the website/mobile app.

The website may also use cookies to activate advertising technology to provide you with ads that may be of interest to you when you visit the search engines, website, mobile app, and/or websites that the website advertises. To offer you specific ads, advertising technology uses information about your previous visits to the website/mobile app and to the websites/mobile applications that the website advertises. In the course of offering these advertisements, a unique third-party cookie may be stored on your browser so that the website can recognize you.

Özak Global Holding also uses Google Analytics, a web analysis service provided by Google Inc. Google Analytics uses cookies to analyze how users use the website, mobile app, and/or mobile site, by statistical information/reports.

You can use the following methods to allow and deny cookies:

Google Chrome

You can allow or deny cookies from the "Cookies" tab by clicking "lock mark" in the address bar of your browser.

Internet Explorer

You can manage cookies by clicking the security tab in the "Tools" menu in the top right of your browser, choosing to "allow" or "block" them.

Mozilla Firefox

Click the "open menu" tab in the top right corner of your browser. You can manage cookies using the ”Privacy and Security“ button by clicking "Options".

Opera

You can manage cookies from the "Cookies" section by selecting "Advanced" in your browser's "Preferences" menu.

Safari

You can manage all of your cookies from the "Privacy and Security" section by selecting the "safari" tab from the "Settings" menu of your phone.

To have information about cookies and cookie management, in addition to the above options, you can visit https://www.allaboutcookies.org and https://www.youronlinechoices.eu/, or use the "Privacy Badger" application (https://www.eff.org/tr/privacybadger).

If you deny persistent cookies or session cookies, you may continue to use the website, mobile app, and mobile site, but you may not be able to access all their functions, or you may have limited access.

Information about cookies on our website is listed in the following table:

Remembering your preferences of functional and analytical cookies contain data on the effective use of the website, optimizing the site to meet user requests, and how visitors use the site. By their nature, such cookies may contain personal information, such as the user name.

3.8. Retention Time Periods for Personal Data

Our Company stores personal data, where stipulated in the relevant laws and regulations, for the period stated in these legislations.

In cases where the legislation does not regulate the period of retention for how long personal data should be stored, personal data is processed for a period, which requires the processing of our data in accordance with the requirements of our Company's practices and precedents of commercial activities, depending on the services offered by our Company, and they shall be then erased, destroyed or anonymized.

If the purpose of processing the personal data expires, and the relevant legislation becomes obsolete, and the retention periods determined by the Company also comes to close, personal data can only be stored for the purposes of potential legal disputes, or claims on related rights linked to personal data, or preparations of statement of defense.

3.9. Kişisel Verileri Silme, Yok Etme Ve Anonimleştirme

KVK Kanunu’nun 7. maddesinde düzenlendiği üzere ilgili kanun hükümlerine uygun olarak işlenmiş olmasına rağmen, işlenmesini gerektiren sebeplerin ortadan kalkması hâlinde Şirketimizin kendi kararına istinaden veya kişisel veri sahibinin talebi üzerine kişisel veriler silinir, yok edilir veya anonim hâle getirilir. Bu kapsamda Şirketimiz ilgili yükümlülüğünü bu bölümde açıklanan yöntemlerle yerine getirmektedir.

Şirketimiz ilgili kanun hükümlerine uygun olarak işlenmiş olmasına rağmen, işlenmesini gerektiren sebeplerin ortadan kalkması hâlinde kendi kararına istinaden veya kişisel veri sahibinin talebi üzerine kişisel verileri silebilir veya yok edebilir. Kişisel verilerin silinmesi, yok edilmesi gereken durumlar veri sorumlusu ve komite tarafından takip edilir.

Kişisel verilerin anonimleştirilmesi, kişisel verilerin başka verilerle eşleştirilerek dahi hiçbir surette kimliği belirli veya belirlenebilir bir gerçek kişiyle ilişkilendirilemeyecek hâle getirilmesini ifade eder. Şirketimiz, hukuka uygun olarak işlenen kişisel verilerin işlenmesini gerektiren sebepler ortadan kalktığında kişisel verileri anonimleştirebilmektedir.

4. CHAPTER 4 - Third Parties to Which Personal Data are Transferred by Our Company, and Transfer Purposes

In compliance with article 10 of the PDP Law, our Company notifies to the personal data subjects the groups of persons to whom the personal data are transferred.

In compliance with articles 8 and 9 of the PDP Law, our Company may transfer the customers’ personal data to the below-listed categories of persons:

• Aktay Otel Işletmeleri A.S.,
• Ozak Yenigun Ziylan Ordinary Partnership,
• Ozak Global Holding A.S,
• Ozak Gayrimenkul Yatirim Ortakligi A.S.,
• Akyon Tesis Yonetim Hizmetleri A.S.,
• Kamer Inşaat Ticaret ve Sanayii A.S., namely
• Our principal shareholders;
• Our related companies, 
• Our group companies,
• Our direct/indirect domestic/foreign affiliates, 
• Program partner entities with which we cooperate, from which we receive services to carry out our activities, entities in the Country/in foreign countries, 
• Our business partners, 
• Our suppliers, 
• Entities from which we receive services,  
• Domestic and international servers we use,  
• Domestic/foreign entities from which we receive cloud services, 
• Persons and entities providing measurement, targeting, profiling supports, processing data on behalf of the data controller, 
• Audit Companies, 
• Advertising and promotion agencies, 
• Public institutions and organizations due to legal obligations, and 
• Other third parties.

5. CHAPTER 5 - Personal Data Processing Activities Performed in Buildings, Premises and Entrance Locations

Our Company carries out personal data processing activities in buildings, premises and entrance locations in compliance with the Constitution, the PDP Law and the other related legislation.

In order that the security is ensured by our Company, our Company conducts monitoring activities by means of security cameras in its buildings and premises as well as personal data processing activities for tracking of guests’ entrances and exits.

Our Company conducts personal data processing activities by use of security cameras and recording of guests’ entrances and exits.

In this context, our Company acts in compliance with the Constitution, the PDP Law and the other related legislation.

5.1. Surveillance activities conducted by use of cameras in buildings, premises and entrance locations

This Section provides explanations on our Company’s camera-surveillance system and furnishes information on how the personal data, privacy and individuals’ fundamental rights are taken under protection.

The purposes of security camera-surveillance activities are to improve the quality of the services provided, ensure the reliability, ensure the security of the Company, the customers and other persons and protect the interests of the customers on the services they receive, etc.

5.1.1. Legal basis of camera-surveillance activities

Our Company conducts and continues performing camera-surveillance activities in compliance with the Law on Private Security Services and the related legislation.

5.1.2. Conduct of security camera-surveillance activities as per the PDP Law

In the conduct of camera-surveillance activities for security purposes, our Company acts in compliance with the provisions contained in the PDP Law.

Our Company carries out security camera-surveillance activities in order to ensure security in its buildings and premises, for the purposes prescribed by the laws and in compliance with the personal data processing conditions listed in the PDP Law.

5.1.3. Announcement of camera-surveillance activities

Our Company elucidates personal data subjects, in compliance with article 10 of the PDP Law.

Thus, it is aimed that the fundamental rights and freedoms of personal data subjects are prevented from being harmed and that transparency and elucidation of personal data subjects are ensured.

5.1.4. Purposes of conducting camera-surveillance activities, and being limited to the purposes

In accordance with article 4 of the PDP Law, our Company processes personal data in such a way in connection with and limited to the personal data processing purposes and in compliance with the principle of proportionality.

The purposes of conducting video camera-surveillance activities by our Company are limited to the purposes referred to in this Policy. Accordingly, the security camera coverage, the number of security cameras and the matter “when surveillance activities will be carried out” are put into practice in such a way adequate for the achievement of the security purposes and limited to these purposes. Video camera- surveillance activities are not carried out in areas (e.g. toilets) where personal privacy takes precedence over the security purposes.

5.1.5. Ensuring security of the data obtained

In compliance with article 12 of the PDP Law, our Company takes the technical and administrative measures necessary for ensuring security of the personal data obtained in result of camera-surveillance activities.

5.1.6. Retention period of the personal data obtained by way of camera-surveillance activities

Detailed information on the retention period of the personal data obtained by our Company through camera-surveillance activities is provided in the Section of this Policy, bearing the heading “Personal Data Retention Periods”.

5.1.7. Persons who may access the data obtained in result of surveillance, and persons to whom these data are transferred

The records saved and stored in digital environment are only accessible by a limited number of Ozak Global Holding employees. Live footages can be viewed by the outsourced security guards. The limited number of persons who have access to the records declare, in their confidentiality undertakings, that they shall protect the confidentiality of the data they will access.

5.2. Tracking of guests’ entrances-exits, conducted in buildings, premises and entrance locations

Our Company carries out personal data processing activities for the tracking of guests’ entrances-exits in the Ozak Global Holding’s buildings and premises, in order to ensure security and for the purposes specified in this Policy.

While obtaining the names and surnames of the persons who visit the Ozak Global Holding’s buildings as a guest, or by means of the texts posted at the Company or otherwise made available for access of the guests, these personal data subjects are elucidated in this context. The data obtained with a view to the tracking of the guests’ entrances-exits are processed only for this purpose, and the relevant personal data are recorded into the data recording system in physical environment.

5.3. Storing of the records related to the internet accesses provided to our guests in the Ozak Global Holding’s buildings and premises

In order to ensure security and for the purposes specified in this Policy, our Company can provide internet access with our quests who make this request, during their stay in our buildings and premises. In this case, the log records related to your internet access are saved in accordance with the Law No. 5651 and the mandatory provisions of the legislation issued under this Law; and these records are processed only in case the competent public institutions and organizations request these records, or in order to fulfill its relevant legal obligation in the audit processes to be performed within the Company.

The log records obtained within this framework are only accessible by a limited number of Ozak Global Holding employees. The Company employees who have access to these records access to these records only to use them for the audit processes or the requests received from competent public institutions and organizations, and the Company employees share these records with legally authorized persons. The limited number of persons who have access to the records declare, in their confidentiality undertakings, that they shall protect the confidentiality of the data they will access.

6. CHAPTER 6 – Rights of Personal Data Subjects, Exercise and Evaluation of these Rights

In compliance with article 10 of the PDP Law, our Company informs the personal data subjects of their rights, and guides them on how to exercise these rights. In compliance with article 13 of the PDP Law, our Company conducts the administrative and technical regulations, the internal functioning and the channels necessary for the evaluation of the personal data subjects’ rights and for the provision of the necessary information to the personal data subjects.

6.7. Rights of personal data subjects and exercise of these rights

6.7.1. Rights of personal data subjects

Article 11 of the Personal Data Protection Law No. 6698 entered into force on 07 October 2016; and the following are your rights you may exercise by virtue of the relevant article as of that date. Everyone is entitled to apply for the data controller and thus, has the following rights:

• To learn whether or not their personal data are processed; 
• To request for relevant information, if their personal data have been processed; 
• To learn the purposes of processing their personal data and whether or not those data are used in compliance with the purposes; 
• To know the third parties in the Country or abroad, to whom their personal data are transferred; 
• To request for rectification in case their personal data have been processed incompletely or inaccurately; 
• To request for erasure or destruction of their personal data within the framework of the conditions prescribed by article 7; 
• To request that the operations carried out under the upper two paragraphs be notified to the third parties to whom their personal data are transferred; 
• To object to occurrence of any results that are to their detriment through analysis of their processed data exclusively by automated systems; 
• To request for compensation of the damages in case they incur damages due to the unlawfully processing of their personal data.

6.7.2. Cases where personal data subjects are not allowed to claim their rights

Since the following cases are excluded from the scope of the PDP Law by virtue of article 28 of the PDP Law, personal data subjects are not allowed to claim their foregoing rights in these following cases:

• In case their personal data are processed for the purposes of official statistics and for the purposes such as research, planning and statistics through anonymization; 
• In case their personal data are processed for the purposes of art, history, literature or science or in the context of the freedom of expression, provided that the data do not violate the national defense, the national security, the public safety, the public order, the economic security, the privacy of private life or personal rights or that they do not constitute an offense; 
• In case their personal data are processed in the context of preventive, protective and intelligence-related activities carried out by public institutions and organizations to which the laws make the assignment and grant the authorization for ensuring the national defense, the national security, the public safety, the public order or the economic security;
• In case their personal data are processed by judicial or execution authorities in relation to investigation, prosecution, judicial or execution proceedings.

By virtue of article 28/2 contained in the PDP Law, personal data subjects are not allowed to claim their rights, with the exception of the right to request for compensation of the damages, in the following cases:

• In case personal data processing is necessary for prevention of an offense or investigation of an offense; 
• In case of processing of personal data made public by the data subject herself/himself; 
• In case personal data processing is necessary, deriving from the conduct of supervision or regulatory duties, or disciplinary investigation or prosecution by competent and authorized public institutions and organizations and professional organizations with public institution status; 
• In case personal data processing is necessary for the protection of economic and financial interests of the State in relation to budgetary, tax-related and financial matters.

6.7.3. Exercise of the rights by personal data subjects

As per the first paragraph contained in article 13 of the PDP Law, it is necessary that the applications, which will be submitted to our Company -namely the data controller- in relation to these rights, are transmitted in writing or through other methods determined by the Personal Data Protection Board (“Board”).  Within this framework, the applications that will be submitted “in writing” to our Company may be conveyed to us:

• by personal application submitted by the applicant; 
• through the channel of a public notary; or 
• by sending the application to the Company’s registered electronic mail address after it has been undersigned by the applicant using “secure electronic signature” as defined in the Electronic Signature Law No. 5070.  In order for you to exercise this right, our contact information is as follows:

Trade Name: Özak Global Holding A.Ş.
Central Registration System (MERSIS) No : 0662078541700017
E-mail Address: ozakglobal@hs01.kep.tr
Mail Address: İkitelli OSB Mah.10 Cad. 34 Portall Plaza No:7D/8 Başakşehir - İstanbul

6.7.4. Personal data subject’s right to file complaint before the PDP Board

In case the application is rejected, the reply is found insufficient, or in case the application is not replied in due time, the data subject may -as per article 14 of the PDP Law- file a complaint before the PDP Board within thirty days following the date he/she learns the reply of the data controller and in any event, within sixty days following the application date.

6.8. Ozak Global Holding’s submission of replies to the applications

6.8.1. Procedure and term for our Company’s submission of replies to the applications

In the event that personal data subjects duly submit their requests to our Company, our Company will conclude the request as soon as possible or within thirty days at the latest, free of charge depending on the nature of the request.

However, if the transaction requires an additional cost, our Company shall collect a fee from the applicant as specified in the tariff determined by the PDP Board.

6.8.2. Information that may be requested from the applicant personal data subject by our Company

In order to identify whether or not the applicant is a personal data subject, our Company may request information from the relevant person.

In order to clarify the matters contained in the personal data subject’s application, our Company may address questions to the personal data subject in relation to his/her application.

6.8.3. Our Company’s right to reject the applications submitted by personal data subjects

In the following cases, our Company may reject the applicant personal data subjects’ applications by explaining the justifications:

• In case their personal data are processed for the purposes of official statistics and for the purposes such as research, planning and statistics through anonymization; 
• In case their personal data are processed for the purposes of art, history, literature or science or in the context of the freedom of expression, provided that the data do not violate the national defense, the national security, the public safety, the public order, the economic security, the privacy of private life or personal rights or that they do not constitute an offense; 
• In case their personal data are processed in the context of preventive, protective and intelligence-related activities carried out by public institutions and organizations to which the laws make the assignment and grant the authorization for ensuring the national defense, the national security, the public safety, the public order or the economic security; 
• In case their personal data are processed by judicial or execution authorities in relation to investigation, prosecution, judicial or execution proceedings; 
• In case personal data processing is necessary for prevention of an offense or investigation of an offense; 
• In case of processing of personal data made public by the data subject herself/himself; 
• In case personal data processing is necessary, deriving from the conduct of supervision or regulatory duties, or disciplinary investigation or prosecution by competent and authorized public institutions and organizations and professional organizations with public institution status; 
• In case personal data processing is necessary for the protection of economic and financial interests of the State in relation to budgetary, tax-related and financial matters; 
• In case it is likely that the personal data subject’s request will block other individuals’ rights and freedoms. 

7. CHAPTER 7 – Corporate Governance Principles for Protection and Processing of Personal Data

Our Company has established a governance structure in order to ensure compliance with the provisions of the PDP Law and secure the effectiveness of the Personal Data Protection and Processing Policy.

In virtue of the resolution taken by the Company’s top management, a “Personal Data Protection Committee” has been constituted within the body of the Company in order to manage this Policy and the other policies that are in connection or associated with this Policy. The tasks of this Committee are specified below.

• To prepare the fundamental policies for the protection and processing of personal data, and to submit those policies to the top management for approval to put them into force; 
• To submit the matters “making the decision on how the personal data protection and processing-related policies shall be implemented and on how the implementations shall be inspected” and “within this framework, making intracompany assignments and ensuring the coordination” to the top management for approval; 
• To determine the matters necessary to be performed for ensuring compliance with the Personal Data Protection Law and the related legislation; and to submit “the actions to be taken” to the top management for approval; to supervise their implementation and to ensure the coordination; 
• To increase awareness about the protection and processing of personal data, within the Company and before the entities with which the Company is in cooperation; 
• To identify the risks that may occur in the personal data processing activities of the Company and thus, to ensure that the necessary measures are taken; to submit the improvement proposals to the top management for approval; 
• To plan trainings on the protection of personal data and the implementation of the policies, and to ensure that these trainings are performed; 
• To resolve the personal data subjects’ applications at the highest level; 
• To coordinate the conduct of the information and training activities in order to ensure that the personal data subjects are informed about the personal data processing activities and their statutory rights; 
• To prepare amendments to the fundamental policies related to the protection and processing of personal data, and to submit these amendments to the top management for approval to put into force; 
• To monitor the developments and regulations on the protection of personal data; to submit recommendations to the top management about the actions to be taken within the Company in compliance with these developments and regulations; 
• To coordinate the relations with the Personal Data Protection Authority and the Personal Data Protection Board; 
• To perform other tasks that will be assigned by the Company top management about the protection of personal data.