İÇTAŞ CONSTRUCTION, INDUSTRY, AND TRADE CORPORATION
PRIVACY NOTICE REGARDING THE PROCESSING OF YOUR PERSONAL DATA
As İçtaş Construction, Industry, and Trade Joint Stock Company (“the Company”), we place the utmost importance on ensuring the security of your personal data. In this context, in accordance with the Personal Data Protection Law No. 6698 (“PDPA”), during the processing of your personal data and its transfer to third parties, we take the necessary measures to ensure an appropriate level of security to prevent the unlawful processing of your personal data and unauthorized access to it, and to ensure the protection of your personal data. For this reason, this text has been prepared to inform the data subjects.
This text will be updated if the entire document or specific provisions thereof are revised by our company.
1. DATA CONTROLLER:
As a company, we are the legal entity that determines the purposes and means of processing your personal data and is responsible for the establishment and management of the data recording system. Upon your explicit consent to the processing of your personal data—or, in cases where explicit consent is not required, following the information we provide—our Company will begin processing your personal data while ensuring data security. While processing your personal data, we may also have one or more data processors process your personal data on our behalf, provided that we ensure the necessary level of security by authorizing them to do so.
2. THE LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA, THE METHODS BY WHICH IT MAY BE COLLECTED, AND WHAT PERSONAL DATA WILL BE PROCESSED:
Your personal data will be processed by our Company in accordance with the provisions of applicable legislation to provide the services to be rendered and to improve the quality of these services; to carry out activities required by public authorities and/or those considered exceptions; to fulfill the Company’s operational obligations; and to comply with data retention, reporting, and to comply with disclosure obligations. Additionally, to enable you to visit our Company, to protect security and legitimate interests related to your visit, to offer our Company’s products and services, to establish communication regarding the products and services you have received or will receive, and to provide services related to our Company’s business activities—such as product/service offers, modeling, reporting, scoring, and risk monitoring—as well as to enhance the quality of these services, carry out other activities, and comply with disclosure obligations—one or more, or all, of your personal data listed in Annex 1 may be processed.
For this purpose, we may share the personal data we process with our affiliates, business partners, suppliers, company officials, shareholders, group companies, and public institutions and private individuals authorized by law, both within and outside Turkey.
3. SHARING OF YOUR PERSONAL DATA:
Your personal data may be collected verbally, in writing, or electronically—in accordance with applicable laws—through our Company, our affiliates, our business partners, and our employees, as well as via our website, social media channels, and any other means.
This information notice is an annex and an integral part of any contract you have signed with our Company and of your requests for the provision of services.
4. DISPOSAL OF YOUR PERSONAL DATA:
Our Company retains your processed personal data for the periods specified by law. However, if the applicable legislation does not specify a retention period for your personal data, your personal data will be retained for as long as necessary to process it in accordance with our Company’s practices and commercial customs related to the services we provide while processing such data, and thereafter only for the periods deemed necessary in practice to serve as evidence in potential legal disputes. Upon the expiration of the specified periods, in accordance with Article 7 of the Personal Data Protection Law, your personal data in question will be deleted, destroyed, or anonymized on the first applicable date.
5. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA:
Under Article 11 of the Personal Data Protection Law, you may submit the following requests to our Company by contacting us:
- To learn whether your personal data has been processed and, if so, to request information regarding such processing,
- To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
- To learn the third parties to whom your personal data has been transferred, whether within or outside the country,
- To request the correction of your personal data if it has been processed inaccurately or incompletely,
- To request that your personal data be erased, destroyed, or anonymized if the grounds for processing your personal data under Article 7 of the Personal Data Protection Law no longer exist,
- To request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
- To object to a decision made solely through the automated processing of your personal data that results in adverse consequences for you,
- To request compensation for any damage you may have suffered as a result of the unlawful processing of your personal data.
You may exercise the rights listed above in accordance with the provisions of the Personal Data Protection Law, the Communiqué on the Procedures and Principles for Applications to the Data Controller published on March 10, 2018, and relevant current legislation, by using the application form available at www.ictas.com.tr;
- by submitting a hand-signed petition in person or via a notary to the following address: Merkez Mahallesi, Silahşör Caddesi, Hilton Hotel, No. 42/1, Şişli/Istanbul; or
- via Registered Electronic Mail to the address [email protected],
- By email to [email protected], including a secure electronic signature or mobile signature,
.
Information regarding the specific application channels through which your applications can be submitted to us is provided below.
| Application Method | Address to Which the Application Should Be Submitted (in the event of an address change, the most recent address published in the Commercial Registry Gazette must be used) | Information to Be Included in the Application |
|---|---|---|
| In-Person Application (The applicant must appear in person with a valid identification document) | Merkez Neighborhood, Silahşör Street, Hilton Hotel, No. 42/1, Şişli/Istanbul | The words “Request for Information Under the Law on the Protection of Personal Data” must be written on the envelope. |
| Service of Process via Notary | Merkez Neighborhood, Silahşör Street, Hilton Hotel, No. 42/1, Şişli/Istanbul | The envelope for service of process must be marked “Request for Information Under the Personal Data Protection Law.” |
| Via Registered Electronic Mail (KEP) | [email protected] | The subject line of the email must read “Request for Information Under the Personal Data Protection Law.” |
| Via email, including a secure electronic signature or mobile signature | [email protected] | The subject line of the email must read “Request for Information Under the Law on the Protection of Personal Data.” |
If a request is made by someone other than the data subject, a notarized special power of attorney issued by the data subject in the name of the person making the request must be provided.
Requests submitted to our Company in accordance with these procedures will be processed within thirty days at the latest. If the resolution of your request entails additional costs, our Company will charge the applicant a fee in accordance with the tariff established by the Personal Data Protection Board (“the Board”). If our Company responds to your request via a storage medium such as a CD or flash drive, a fee may be charged, provided that it does not exceed the cost of the storage medium.
Our Company may request the necessary information and documents from you to determine whether you are the actual owner of the personal data in question, and may ask you questions regarding your request to clarify the matters specified therein.
Our company may reject your request, stating the reasons, in the following cases:
- The processing of your personal data for purposes such as research, planning, and statistics, where such data has been anonymized through official statistical methods.
- The processing of your personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public safety, public order, economic security, the privacy of private life, or personal rights, nor constitute a crime.
- The processing of your personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security.
- The processing of your personal data by judicial authorities or enforcement agencies in connection with investigations, prosecutions, trials, or enforcement proceedings.
- The processing of your personal data when necessary to prevent the commission of a crime or to conduct a criminal investigation.
- The processing of your personal data that you have made public.
- The processing of your personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or prosecutions, by competent and authorized public institutions and organizations, as well as professional organizations with the status of public institutions, based on the authority granted by law.
- The processing of your personal data is necessary to protect the State’s economic and financial interests regarding budgetary, tax, and financial matters.
- There is a possibility that your request may infringe upon the rights and freedoms of others.
- You have made requests that require a disproportionate amount of effort on our part.
- The information you requested is publicly available.
Our Company will notify you of its response to your request in writing or electronically. Pursuant to Article 14 of the Personal Data Protection Law, in cases where your request is rejected, you deem our Company’s response insufficient, or no response is provided within the prescribed timeframe: You may file a complaint with the Board within 30 (thirty) days from the date you receive our Company’s response—or, if we fail to respond, from the expiration of the response period—and in any case within 60 (sixty) days from the date of your request.
APPENDIX 1: Categories of Personal Data
| Identity Information | Information clearly belonging to an identified or identifiable natural person; processed either partially or fully automatically, or non-automatically as part of a data recording system; all information contained in documents such as Driver’s Licenses, National ID Cards, Residence Permits, Passports, Attorney ID Cards, marriage certificates |
|---|---|
| Contact Information | Information that clearly pertains to an identified or identifiable natural person; processed either partially or fully automatically or non-automatically as part of a data recording system; such as phone number, address, and email address |
| Physical Premises Security Information | Personal data clearly belonging to an identified or identifiable natural person and contained within a data recording system; personal data related to records and documents collected upon entry to a physical location and during the time spent within that location |
| Transaction security information | Personal data clearly belonging to an identified or identifiable natural person and stored within the data recording system; your personal data processed for the purpose of ensuring compliance with technical, administrative, legal, and commercial obligations while conducting our business activities |
| Risk management information | Personal data clearly belonging to an identified or identifiable natural person and contained within the data recording system; personal data processed through methods used in accordance with generally accepted legal principles, commercial practices, and the principle of good faith in these areas to enable us to manage our commercial, technical, and administrative risks |
| Financial information | Personal data clearly attributable to an identified or identifiable natural person, processed either partially or fully automatically or non-automatically as part of a data recording system; personal data of subcontractors, supplier representatives, or employees related to information, documents, and records reflecting the data subject’s financial outcomes of any kind |