INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA VIA CCTV
DATA CONTROLLER PROCESSING YOUR DATA
As TURKUAZ ELEKTROTEKNİK SANAYİ VE TİCARET LTD. ŞTİ. (“Company”), we attach utmost importance to ensuring the security of your personal data. Within the scope of the Personal Data Protection Law No. 6698 (“Law”), in our capacity as the data controller, all necessary technical and administrative measures are meticulously implemented to ensure that your personal data is processed lawfully, stored securely, and transferred in compliance with the applicable legislation when necessary.
In this context, the necessary organizational structure has been established within our Company to prevent the unlawful processing and access of your personal data, to ensure its preservation, and to guarantee data security. Data processing activities are carried out in accordance with the Law and relevant secondary legislation.
As the data controller, our Company processes your personal data for the purposes and within the scope explained below, in full compliance with the relevant legislation.
Address: Ömerli Mahallesi Nusret Street No: 7/1 Arnavutköy Istanbul
E-mail: turkuazelektroteknik@hs01.kep.tr
Website: https://www.turkuazelektroteknik.com/
YOUR PROCESSED PERSONAL DATA
Your personal data may be processed through the closed-circuit camera recording system (CCTV) established by our Company to ensure security in campuses, buildings, production areas, offices, and similar physical locations.
The personal data that may be processed within this scope are listed below:
Physical Space Security Data:
Image recordings obtained through camera systems located within the Company premises and affiliated areas, and CCTV data belonging to real persons within these recordings.
METHOD OF COLLECTING YOUR PERSONAL DATA
Your personal data is collected in order for our Company to carry out its activities in a secure, controlled, and legally compliant manner;
a. Through CCTV camera systems positioned in buildings, facilities, production areas, warehouses, entry-exit points, and similar physical locations belonging to our Company, by automatic means,
and is collected accordingly.
These data collection activities are carried out to ensure the security of employees, visitors, and third parties who have a business relationship with the Company, to control business processes, and to prevent potential risks.
PURPOSE AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
Your personal data obtained through the camera recording system is processed limited to the purposes detailed below:
• Ensuring the effective execution of emergency management processes,
• Ensuring and maintaining information security processes,
• Conducting audit and ethics activities,
• Ensuring that Company activities are carried out in compliance with the relevant legislation,
• Ensuring and controlling physical space security,
• Monitoring and conducting legal affairs, creating and preserving records that may serve as evidence in possible disputes,
• Conducting internal audit, review, investigation, and intelligence activities,
• Carrying out business activities and supervising operational processes,
• Conducting occupational health and safety processes and ensuring necessary controls within this scope,
• Planning and implementing risk management processes,
• Ensuring the security of Company assets, equipment, and resources,
• Ensuring the security of data controller operations,
• Providing information to authorized persons, institutions, and organizations within the scope of legal obligations arising from legislation,
• Protecting the life and property security of the Company and relevant persons.
Your personal data is processed based on the legal grounds set forth in Article 5 of the Law;
• It is mandatory for the data controller to fulfill its legal obligation,
• It is mandatory for the establishment, exercise, or protection of a right,
• It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
and is processed accordingly.
SHARING OF YOUR PERSONAL DATA
Your collected personal data may be shared with third parties in a limited, proportionate manner and in compliance with legislation, solely for the fulfillment of the processing purposes specified above. In this context, your personal data;
a. To ensure security in Company premises, buildings, production areas, warehouses, offices, and other physical locations,
b. To carry out emergency management processes,
c. To fulfill occupational health and safety processes and internal control and audit activities conducted within this scope,
d. To prevent, monitor, and, when necessary, resolve legal disputes,
e. To be used as evidence in possible disputes, administrative reviews, or judicial processes,
f. To provide information to authorized public institutions and organizations, judicial authorities, administrative authorities, and law enforcement agencies upon request in accordance with relevant legislation,
g. To carry out internal audit, review, investigation, and security evaluation processes,
h. To carry out, monitor, and supervise business activities,
i. To plan and implement risk management processes,
j. To ensure the security of data controller operations
may be transferred within the framework of the personal data transfer conditions set forth in Article 8 of the Law.
Within this scope, your personal data may be transferred, if necessary and limited to the purpose of transfer, to authorized public institutions and organizations, judicial and administrative authorities, law enforcement units, lawyers from whom consultancy is obtained for the follow-up of legal processes, authorized persons and organizations within the scope of audit activities, and suppliers providing technical maintenance, repair, support, security, or infrastructure services for camera recording systems.
However, during these transfer processes, the principle of data minimization is observed, only the necessary data set is shared, and the necessary contractual, technical, and administrative measures are taken to ensure data security. Our Company exercises due diligence to ensure that third parties from whom it receives services also comply with obligations regarding the protection of personal data.
DESTRUCTION OF YOUR PERSONAL DATA
Personal data processed by our Company is retained for the retention periods stipulated in the relevant legislation. If no explicit retention period is specified in the legislation, personal data is retained for a reasonable period required for the purpose for which it is processed, taking into account the Company’s field of activity, operational needs, burden of proof obligations, legal obligations, and the necessity to preserve its nature as evidence in possible disputes.
Regarding CCTV recordings belonging to you, retention periods are determined in accordance with our Company’s VERBIS records and data retention approach, and the retention period for physical space security data is applied as 1 month. However, depending on the nature of the specific case, if there is a judicial or administrative review, dispute, work accident, security breach, internal audit process, or an official process conducted by authorized authorities, the relevant records may additionally be retained, provided that it is limited and proportionate, until the completion of these processes.
Upon the expiration of the retention period or if the legal grounds requiring the processing of personal data cease to exist, the relevant personal data is deleted, destroyed, or anonymized ex officio or upon the request of the data subject at the first periodic destruction date, in accordance with Article 7 of the Law and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
While carrying out destruction processes, our Company uses methods appropriate to the nature of the data, the environment in which it is stored, and the technical infrastructure, thus ensuring that personal data is destroyed in a way that it cannot be recovered, reused, or accessed.
YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA
Pursuant to Article 11 of the Law, you may exercise the following rights by applying to our Company regarding your personal data:
a. To learn whether your personal data is processed,
b. To request information if your personal data has been processed,
c. To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
d. To know the third parties to whom your personal data is transferred domestically or abroad,
e. To request correction of your personal data if it is incomplete or incorrectly processed,
f. To request deletion, destruction, or anonymization of your personal data within the framework of Article 7 of the Law,
g. To request notification of the transactions made within the scope of correction, deletion, destruction, or anonymization to third parties to whom your personal data has been transferred,
h. To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
i. To request compensation for damages in case you suffer damage due to unlawful processing of your personal data.
You may submit your applications regarding the above-mentioned rights to our Company in accordance with the Law, the Communiqué on the Procedures and Principles of Application to the Data Controller, and other relevant legislation.
You may submit your applications;
• By delivering it in person to Ömerli Mahallesi Nusret Street No: 7/1 Arnavutköy Istanbul, via a notary public or by registered mail with return receipt,
• Through your e-mail address registered in the Company systems by using the appropriate application channels of our Company,
• By sending it to turkuazelektroteknik@hs01.kep.tr via secure electronic signature, mobile signature, or registered electronic mail.
If the application is made by a third party on behalf of the data subject, a notarized special power of attorney issued on behalf of the applicant must be submitted.
Our Company will finalize duly submitted applications free of charge as soon as possible and at the latest within thirty days, depending on the nature of the request. However, if the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged to the applicant.
Our Company may request additional information and documents to determine whether the applicant is the personal data owner and may ask additional questions to clarify the matters stated in the application.
Pursuant to Article 14 of the Law, in cases where the application is rejected, the response is found insufficient, or no response is given within the period, the data subject has the right to file a complaint with the Personal Data Protection Board within thirty days from the date of learning the Company’s response and in any case within sixty days from the date of application.