PERSONAL DATA PROTECTION LAW

ESTA İNŞAAT SANAYİ LOJİSTİK VE DIŞ TİCARET AŞ

CLARIFICATION TEXT WITHIN THE SCOPE OF THE PERSONAL DATA PROTECTION LAW NO. 6698

Esta İnşaat Sanayi Lojistik ve Dış Ticaret AŞ ("Company") takes all kinds of technical and legal measures in accordance with the Personal Data Protection Law No. 6698 ("KVKK") in the processing of your personal data due to the activities it carries out. Data subjects can access detailed information on the processing of their personal data, transfer of personal data to third parties, legal reasons for collecting personal data and their rights under the KVKK from the following clarification text.

A. Personal Data Processed, Purpose of Data Processing, Collection Method and Legal Reason for Processing

The legal reasons that our company relies on during data processing are as follows:

Presence of explicit consent (“Article 5/1, Article 6/2”).
It is explicitly stipulated in the law (“Article 5/2-a").
It is necessary for the protection of the life or bodily integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid, or of another person (“Article 5/2-b").
Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract (“Article 5/2-c").
The obligation of the data controller to fulfill its legal obligation (“Article 5/2- o").
The fact that it has been publicised by the person concerned (“Article 5/2-d").
Data processing is mandatory for the establishment, exercise or protection of a right (“Article 5/2-e").
Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (“Article 5/2-f").

Purpose of Data Processing	Personal Data Processed	Data Processing Conditions	Data Collection Methods
Execution of Goods/Services procurement and contract/tender processes	Name, Surname, Turkish ID No, Signature Circular, E-Mail, Phone, Tax ID No, Tax Office, Bank Account Number, Signature, Address, Reference Information	Article 5/2-c, Article 5/2-e, Article 5/2-f.	Physical, E-Mail, Telephone (by partially automatic and non-automatic means)
Execution of contractual pay processes	Name Surname, E-Mail, Phone, Tax Office, Turkish ID No, Bank Information	Article 5/2-c, Article 5/2-o, Article 5/2-f.	Phone, E-Mail, Physical (Partially automatic and non-automatic means)
Execution of sales and contract processes, Execution of after-sales processes	Name, Surname, Identity Information, Signature Circular, E-Mail, Telephone, Tax Office, Bank Information, Signature, Address, Contract Amount, Photo, Passport Copy and Tax Identification Number (if foreign), Power of Attorney for Subscription Transactions, Insurance Transactions	Article 5/2-c, Article 5/2-e, Article 5/2-f.	Physical, E-Mail, Telephone (by partially automatic and non-automatic means)
Ability to maintain communication	Name Surname, E-Mail, Phone	Article 5/2-c, Article 5/2-e, Article 5/2-f.	E-Mail, Physical (Partially automated means)
Tracking of housing sale pays	Identity Information, Passport Information, Address, Phone, Promissory Note Information	Article 5/2-c, Article 5/2-e, Article 5/2-f.	Physical, E-Mail, Telephone (by partially automatic and non-automatic means)
Execution of billing processes	Name surname, Turkish ID No, Tax Office, Phone, Address	Article 5/2-c, Article 5/2-o, Article 5/2-f.	Physical, E-Mail, Telephone (by partially automatic and non-automatic means)
Execution of E-Archive and E-Billing processes	Turkish ID No, Phone, E-Mail, Bank Account Information, First Name Last Name, Address, Apartment, MERSIS (Central Registry) no	Article 5/2-c, Article 5/2-o, Article 5/2-f.	Physical, E-Mail, Telephone (by partially automatic and non-automatic means)
Creating Customer/Supplier current card	Turkish ID No, Phone, E-Mail, Name, Surname, Address, Apartment and Trade Registry Information, Housing Information (If he/she is a Housing Buyer)	Article 5/2-o, Article 5/2-e.	Physical, E-Mail, (Partially automatic and non-automatic means)
Creating a supplier list	Name Surname, Phone, Address, E-Mail	Article 5/2-c, Article 5/2-f.	Verbal, E-Mail, (By means of partially automatic and non-automatic means)
Execution of goodwill contract processes	Name Surname, E-mail, Phone Number	Article 5/2-c, Article 5/2-o, Article 5/2-f.	E-Mail, Phone (partially by automated means)
Realisation of customer marketing, Prospect interviews in fair organisation processes	Name Surname, Date of Birth, Marital Status, Phone, E-mail, Profession, Address, Children's Name Surname, Children's Date of Birth, Project of Interest, Contact Preference Information, Company Information, Date, Signature, Reason for project preference, Budget- Type of Residence of Interest- Additional Notes	Article 5/1, Article 5/2-c, Article 5/2-e, Article 5/2-f.	Physical Call, Call Center, Social Media, Form, Digital Channels (by automatic and non-automatic means)
Execution of potential customer relations, detailed information about the sale	Name Surname, E-Mail, Phone	Article 5/1	Physical, Call Center, Social Media, Form, Digital Channels (by automatic and non-automatic means)
Project control and approval within the scope of work	Name Surname, Phone, E-mail, Address	Article 5/2-e, Article 5/2-f.	E-Mail, Phone (partially by automated means)
Ensuring security by recording the work areas	Camera Recording, Audio Recording	Article 5/2-f.	Camera system (by automatic means)
Ensuring security controls at the entrances	Name Surname, Person Visited, Check-in and Check-out Time, License Plate Information	Article 5/2-f.	Verbally (by non-automatic means)
Tracking of log records within the framework of transaction security	Log Records, IP, Mac, User Name, Date, Time, The Site to which Access is Provided	Article 5/2-o, Article 5/2-f.	Firewall (by automatic means)
Providing Internet access	Name Surname, Turkish ID No, Phone, Mac Address	Article 5/2-o, Article 5/2-e, Article 5/2-f.	Electronic (by automatic means)
Performing digital device backup and maintenance	Personal data that may be included in the device	Article 5/2-e, Article 5/2-f.	Device (by automatic means)
Follow-up of litigation, mediation and enforcement processes	Personal data that is the subject of the file and/or contained in the file	Article 5/2-a, Article 5/2-c, Article 5/2-o, Article 5/2-e, Article 5/2-f.	Physical (by non-automatic means)
Management of claims and complaints processes	Name, Surname, Turkish ID No, Phone Number, E-Mail, Details of the Problem If There has Been a Problem	Article 5/2-c, Article 5/2-e, Article 5/2-f.	E-Mail, Phone, Physical, Website (Partially by automatic or non-automatic means)
Conducting correspondence with public institutions and organizations	Personal data that is the subject of a request or notification	Article 5/2-a, Article 5/2-c, Article 5/2-o	Physical, e-mail (by non-automatic or partially automatic means)

B. Transfer of Personal Data

Your processed personal data may be transferred to the following for the above purposes and within the framework of the conditions determined by the KVKK:

To legally authorised and relevant public institutions and organisations in line with the requests of authorised and relevant public institutions and organisations and within the framework of legal regulations, in connection with and limited to their requests,
To banks, suppliers, domestic or foreign business partners in order to exercise contractual rights and fulfil obligations, to carry out payment and tax processes, to carry out transactions specific to the industry in which we operate,
To independent audit companies, expert consultants, supervisory and regulatory authorities, authorised institutions and organisations, domestic or foreign business partners in order to fulfil our contractual and legal obligations,
To our business partners in Türkiye or abroad in order to carry out logistics processes in the procurement of goods carried out on behalf of our business partners,
To our authorised call centre suppliers in order to carry out communication processes within the scope of information, promotion, advertisement etc. about our projects,
To our suppliers, audit firms, information security firms from which we receive services in order to establish the necessary quality, confidentiality and standards,
To real and legal persons and public institutions and organisations with whom we cooperate in order to realise the fields of activity of our Company,
To the police, courts and authorised institutions and organisations, our authorised consultants in order to ensure the safety of the company and to ensure that legal processes are initiated,
In order to realise the advertisement and definition of the company, it is shared publicly on the website, social media accounts, in written and printed form and to our authorised suppliers within this scope,
To our solution partner companies, suppliers and companies operating in this field that carry out repair, maintenance, repair and service services,
To domestic and foreign software companies, our suppliers operating in the field of operating systems, computer programs, software, cloud service that we use within the company and for the purpose of performing their maintenance,
To our suppliers and business partners in Türkiye and/or abroad in order to increase the awareness and brand value of the company, to improve the internet infrastructure and to keep it up-to-date,
To institutions/organisations established in Türkiye and abroad and providing services in the field of security, technology and cloud services.

C. Rights of the Person Concerned

Everyone has the following rights pursuant to Article 11 of the KVKK;

To learn whether his/her personal data has been processed or not,
To request information if personal data has been processed,
To learn the purpose of processing the personal data and whether they are used in accordance with the purpose,
To know the third parties to whom personal data are transferred at home or abroad,
To request correction of personal data in case of incomplete or incorrect processing of personal data and to request notification of the transaction made in this context to the third parties to whom the personal data are transferred,
Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
To object to the emergence of a result to the detriment of the person himself/herself by analysing the processed data exclusively through automated systems,
To request compensation of the damage in case of suffering damage due to unlawful processing of personal data.

Everyone can submit their requests regarding these rights to our Company in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests will be evaluated and decided free of charge as soon as possible and ultimately within thirty (30) days at the latest. If the evaluation and decision-making process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be taken as basis.