Privacy Notice on the Protection of Personal Data Relating to Employee Candidates

Pursuant to Law No. 6698 on the Protection of Personal Data (“KVKK”) and Regulation (EU) 2016/679 General Data Protection Regulation (“GDPR”), and within the scope of fulfilling the data controller’s obligation to inform, through this Privacy Notice we, Gözen Holding A.Ş. (“Company”, “we”), acting as data controller, aim to inform you about your personal data that is processed.

1. WHAT ARE YOUR PROCESSED PERSONAL DATA?

  • Identity Information: Name-surname, Turkish Republic ID number, gender, place of birth, date of birth, marital status
  • Contact Information: Email, telephone number, address information
  • Professional Experience Information: Diploma information, courses attended, education history, in-service training information, certificates, transcript information, previous employment information (title, profession information, previous workplace, previous job, periods of unemployment)
  • Visual and Audio Records: Photo/video images recorded within the scope of candidate evaluation activities.
  • Health Information: Information on disability status, device and prosthesis information (only for disabled employee candidates)
  • Other Information: Information regarding military service status, signature, photograph, driver’s license/vehicle information

2. WHAT ARE THE METHOD, PROCESSING PURPOSES AND LEGAL BASIS OF THE COLLECTION OF YOUR PERSONAL DATA?

Your personal data mentioned above are collected by automatic and/or partially automatic methods during the establishment of your relationship with us and during the continuation of the relationship in question, for the purposes and based on the reasons for compliance with the law set out below.

PERSONAL DATA CATEGORY

PURPOSES

LEGAL BASIS

  • Identity Information
  • Contact Information
  • Professional Experience Information
  • Visual and Audio Records
  • Other Information
  • Conducting employee candidate / intern / student selection and placement processes
  • Conducting application processes for employee candidates
  • Planning human resources processes
  • Conducting talent / career development activities
  • Making internal company announcements
  • Conducting corporate and internal communication processes
  • Conducting archiving activities
  • Conducting dispute processes such as litigation, arbitration or mediation to which the Company is a party
  • Conducting activities required for compliance with ground handling security policies and procedures
  • Necessary for the establishment or performance of a contract (KVKK Art. 5/2-c) (GDPR Art. 6/1-b)
  • Necessary for compliance with our legal obligations (KVKK Art. 5/2-ç) (GDPR Art. 6/1-c)
  • Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2-e) (GDPR Art. 6/1-f, where applicable)
  • Legitimate interests of the data controller, provided that fundamental rights and freedoms are not harmed (KVKK Art. 5/2-f) (GDPR Art. 6/1-f)
  • Health Information (only for disabled employee candidates)
  • Fulfilling legal obligations
  • Conducting employee candidate / intern / student selection and placement processes
  • Conducting application processes for employee candidates
  • Planning human resources processes
  • Explicitly provided for by laws (KVKK Art. 5/2-a)
  • Explicit consent, where required (KVKK Art. 5/1 and Art. 6) (GDPR Art. 6/1-a and Art. 9/2-a, where applicable)
  • Necessary for compliance with legal obligations (KVKK Art. 5/2-ç) (GDPR Art. 6/1-c)
  • Processing of special categories of data only where permitted by applicable KVKK and GDPR rules

3. TO WHOM YOUR PERSONAL DATA ARE TRANSFERRED AND WHAT ARE THE PURPOSES OF TRANSFER?

Your personal data may be transferred to third parties only in the following cases, in accordance with the provisions of KVKK and GDPR regarding the transfer of personal data, limited to, relevant to and proportionate with the purposes of processing.

RECIPIENT GROUP

PURPOSES

  • Authorized persons, institutions or organizations
  • Fulfillment of our legal obligations, including providing information to authorized persons, institutions or organizations, conducting legal processes and carrying out our activities in compliance with legislation.
  • Gözen Holding A.Ş. Group Companies
  • We may share your information with holding group companies where necessary for ensuring compliance with Gözen Holding A.Ş. Group Companies’ Human Resources policies, conducting audits and reporting, and fulfilling office management, physical security or administrative/managerial assignments carried out by Company management, administrative affairs, and technical and technological activities. Information about our holding companies can be accessed at https://gozenholding.com/.

4. WHAT ARE THE PURPOSES OF CROSS-BORDER TRANSFER IF YOUR PERSONAL DATA IS TRANSFERRED ABROAD?

Your personal data may be transferred abroad for data storage and communication service provision. We would like you to know that, due to the Company’s use of digital services such as cloud applications and storage, hosting and communication systems from service providers located abroad, your personal data may be transferred abroad. Such transfers are carried out in accordance with KVKK rules on cross-border transfers and, where applicable, GDPR requirements, including appropriate safeguards, adequacy mechanisms or explicit consent where required.

5. HOW LONG IS YOUR PERSONAL DATA STORED?

Your personal data is not retained for longer than necessary. In accordance with our Company procedure, the retention period for your personal data is 2 years if recruitment does not take place, 3 years if retained for evaluation for suitable positions in the future, and, where recruitment takes place, throughout the term of your employment contract and for 5 years from the date of termination of the employment contract for any reason. At the end of this period, the data is destroyed.

For personal data that we process solely based on your explicit consent, we would like to state that you may withdraw your explicit consent at any time. If you submit your request to withdraw explicit consent to us, the relevant personal data will be promptly deleted/destroyed.

Our Company also undertakes to ensure the security of your personal data. Therefore, technical and organizational measures are taken within the scope of KVKK and GDPR to protect your personal data against unauthorized access, use or disclosure.

6. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

Under Article 11 of KVKK, you have the following rights regarding your personal data:

  • Right to Information: To learn whether personal data is processed, to request information if personal data has been processed, and to learn the purpose of processing and whether the data is used in accordance with that purpose.
  • Right of Access: To know the third parties to whom personal data has been transferred domestically or abroad.
  • Right to Rectification: To request correction if personal data is incomplete or inaccurate.
  • Right to Erasure: To request deletion or destruction of personal data.
  • Right to Notification: To request notification of correction, deletion or destruction operations to third parties to whom personal data has been transferred.
  • Right of Object: To object to a result arising against you through analysis of processed data exclusively by automated systems.
  • Right to Compensation: To request compensation for damages if you suffer damage due to unlawful processing of personal data.

Under Chapter 3 of the GDPR, where applicable, you have the following rights regarding your personal data:

  • Right to be Informed: Organizations must tell individuals what personal data is collected, how it is used, how long it will be stored and whether it will be shared with third parties.
  • Right of Access: Individuals have the right to request a copy of the information an organization holds about them.
  • Right to Rectification: Individuals have the right to correct inaccurate or incomplete data
  • Right to Erasure and to be Forgotten: In certain cases, individuals may request organizations to delete personal data stored about them, including online.
  • Right to Data Portability: Individuals may request that organizations transfer all data held about them to another company.
  • Right to Restriction of Processing: Individuals may request that an organization restrict the way it uses their personal data.
  • Right to Object: Individuals have the right to object to certain types of processing, such as direct marketing.
  • Rights Regarding Automated Decision-Making and Profiling:Individuals may request information about automated processing activities if they believe data has been processed unlawfully, and must be informed that they are free to exercise their rights and how to do so.

7. HOW CAN YOU EXERCISE YOUR LEGAL RIGHTS?

In order to exercise the rights granted to data subjects under Article 11 of the Law on the Protection of Personal Data and Chapter 3 of the GDPR, certain procedures are set out in the Communiqué on the Procedures and Principles for Application to the Data Controller. To exercise your rights and obtain information about your rights:

  • You may submit your requests in person to the address of our Company stated below, subject to identity verification, or send them through a notary public.
  • Gözen Holding A.Ş., Simetri Ofis - Çobançeşme Mah. Sanayi Cad. No:60 Kat:6 34197 Bahçelievler - İstanbul/Türkiye,
  • You can apply to our company's dpo@gozenholding.com e-mail address or our company's registered electronic mail (KEP) gozenholding@hs01.kep.tr address with your secure electronic signature and mobile signature or your e-mail address previously notified to us by you and confirmed by us in our systems.