Privacy Notice

The protection of personal data is among the foremost priorities of Sistem Alüminyum Sanayi ve Ticaret A.Ş. ("Sistem Alüminyum"), which makes every effort to comply with all applicable legislation in this regard.

This Privacy Notice is intended to inform you about your personal data processed by Sistem Alüminyum pursuant to Article 10, entitled "Obligation of the Data Controller to Inform", of the Law on the Protection of Personal Data No. 6698 ("KVKK"), published in the Official Gazette dated 7 April 2016 and numbered 29677, and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, published in the Official Gazette dated 10 March 2018 and numbered 30356. The KVKK aims to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, in relation to the processing of personal data.

Identity of the Data Controller

Sistem Alüminyum Sanayi ve Ticaret A.Ş. ("Sistem Alüminyum") acts as the data controller under the Law on the Protection of Personal Data No. 6698 in respect of the personal data it processes in the course of its activities. The identity and contact details of the data controller are set out below.

Company Name	Sistem Alüminyum Sanayi ve Ticaret A.Ş.
Address	Akçaburgaz Mahallesi, 3055. Sokak, No: 4, 34522 Esenyurt / İstanbul
Website	www.sistemal.com
Email Address	sistem@sistemal.com
Phone Number	0212 886 87 87
Fax	0212 886 53 29
MERSİS Number	0771-0034-5060-00142

Categories of Personal Data Processed

Data Category	Description
Identity Information	First name, surname, date of birth, country and city of birth, gender, marital status, nationality and Turkish identity card details. These details may include the Turkish identity number, serial number, identity document number, father’s name, mother’s name and, for old-style identity cards, place of birth, province, district, neighbourhood, volume number, family record number, individual record number, household number, page number, registration number, place of issue, reason for issue, date of issue and previous surname.
Contact Information	Telephone number, full address, email address and internal company contact details, including extension number and corporate email address.
Education Information	Educational attainment, school name, academic term details, graduation grade point average, foreign language proficiency, education and skills, specialised courses, seminars and courses attended, certification details and computer proficiency.
Work Experience Information	Professional experience, position and title, employment history, previous employers, periods of employment and job description.
Family Members and Relatives Information	Contact, education, health, financial and identity information concerning an employee’s relatives that is necessary for the employee to benefit from social entitlements, together with the date of marriage, number of children and details of family members.
Visual Information	Photographs and video recordings.
Financial Information	Financial information and salary details, payroll records, case and debt details relating to enforcement proceedings, bank passbook, amounts relating to private or supplementary health insurance, minimum subsistence allowance information, IBAN, account number and the bank with which the account is held.
Association Foundation and Trade Union Membership Data	Information concerning membership of associations, foundations or trade unions.
Health Data	Disability status, description and percentage; blood group; private health insurance policy; medical reports; fitness-for-work report; hearing and vision tests; pre-employment and periodic medical examination forms; pregnancy status and pregnancy report; sick leave and maternity leave information; blood group stated on an identity card or driving licence; and details of medical devices and prostheses used.
Religion Data	Religion information appearing on old-style identity cards. This data is not specifically processed.
Employee Performance and Career Development Data	Education and skills, dates of training received, email address, signed attendance form, customer interaction quality assessment form, monthly performance assessment, target achievement status, activity information and attendance records.
Personnel Attendance Information	Clock-in and clock-out times, leave information and fingerprint data.
Other	Data contained in the employment commencement notification submitted to the Social Security Institution (SGK), certificate of residence, detailed civil registry extract, copy of bank passbook, reasons stated on leave or medical report forms, reference information, hobbies, vehicle registration number, military service status, reason for termination of employment, driving licence details, passport details and body measurements.

Purposes of Processing Personal Data

Personal data processed by Sistem Alüminyum may be processed for the following purposes, subject to the implementation of proportionate technical and administrative measures to ensure data security:

Improving, developing and diversifying our services and activities, developing alternatives, and offering them to persons with whom we have a commercial relationship.
Conducting emergency management processes for our company’s buildings, facilities and work areas.
Managing information security and access authorisation processes.
Managing the applications of candidates seeking employment with our company.
Conducting employee satisfaction and engagement processes.
Fulfilling obligations arising from employment contracts and applicable legislation in respect of our employees.
Administering employee benefits and entitlements.
Fulfilling our legal obligations, particularly those relating to audit and ethics activities required by applicable legislation.
Conducting training activities for company employees.
Conducting our activities in compliance with applicable legislation.
Conducting finance and accounting operations.
Managing loyalty processes relating to the company, its products and services.
Ensuring physical security at our company’s buildings, facilities and work areas.
Monitoring and managing legal affairs.
Conducting communication activities.
Conducting occupational health and safety activities.
Receiving and evaluating suggestions for improving business processes.
Conducting activities to ensure business continuity.
Conducting logistics activities.
Conducting customer relationship management processes.
Conducting customer satisfaction activities.
Managing organisational activities and events.
Conducting marketing analyses.
Conducting performance assessment processes.
Conducting retention and archiving activities.
Conducting social responsibility and civil society activities.
Fulfilling our contractual obligations fully and completely.
Conducting strategic planning activities.
Monitoring requests and complaints addressed to our company.
Ensuring the security of movable assets and resources.
Conducting supply chain management processes.
Implementing the remuneration policy.
Conducting marketing processes for products and services.
Ensuring the security of the data controller’s operations.
Providing information to authorised persons, institutions and organisations.
Conducting management activities.
Creating and maintaining visitor records.
Fulfilling our obligations under Law No. 5651 where internet access is provided, generating statistical data, and responding to persons who contact our company.
Notifying you of changes to our policies.

Transfer of Personal Data

Personal data processed by Sistem Alüminyum may be transferred to the following persons and entities for the purposes for which the personal data is processed:

To our business partners, suppliers and customers, to perform our activities and services and ensure their continuity and coordination.
To our suppliers, shareholders, banks, tax offices and other public institutions and organisations responsible for overseeing payment processes, to execute payments and conduct banking and financial transactions.
To audit firms and the relevant public institutions and organisations, to audit our activities.
To our suppliers, audit firms, certification bodies and information security firms, to establish the necessary quality and confidentiality requirements and standards.
To judicial bodies, judicial authorities, law enforcement agencies and other legally authorised public institutions and organisations, in response to requests from public institutions and organisations.
To insurance companies and banks, to administer insurance and private pension processes.
To courier companies, PTT and notaries public, to conduct communication and dispatch processes.
To our business partners, shareholders, suppliers and customers, to formulate and implement strategies relating to our activities.
To the relevant software companies, suppliers and cloud service providers, for the operation, maintenance and repair of the operating systems, computer programs, software and cloud services used within the company.
To third parties requesting references on a valid legal basis.
To third parties named as referees by the data subject, to assess the competence of an employee, job candidate or business partner.
To healthcare institutions, hospitals, third parties authorised by law and the relevant public institutions and organisations, to fulfil our obligations relating to emergency medical intervention and occupational health and safety legislation.
To our business partners, suppliers and shareholders, to improve our quality standards, reduce costs and develop our marketing strategies.
To third-party travel and accommodation service providers, consulates, visa application centres and legally authorised persons, to arrange domestic and international travel and accommodation.
To our suppliers and research and survey companies, to conduct research and surveys concerning customer and employee satisfaction.
To our business partners and suppliers, to conduct advertising, publicity and promotional activities.
To our shareholders and business partners, to plan and conduct human resources processes and ensure their continuity.
To cloud service providers, to store and back up information and documents held by the company.
To email service providers, where personal data needs to be transferred by email.
To suppliers providing human resources support, to conduct human resources and recruitment activities.

Methods of Collection and Legal Basis for Processing Personal Data

Personal data held by Sistem Alüminyum is collected orally, in writing or electronically, with due regard to the conditions for processing personal data set out in the KVKK, primarily through the following means:

Cookies and log records used online.
Social media applications.
Requests submitted to our call centre.
Surveys.
Contracts and proposals.
Applications and communications made in person, by post or electronically.
Audio and video recordings made by CCTV systems within Sistem Alüminyum’s head office, factory buildings, work areas and facilities.
Face-to-face interviews and meetings.
Information provided through our business and solution partners.
Persons named as referees by the data subject.
Companies from which we receive human resources support.
Official correspondence received from public institutions and organisations.

Retention and Disposal of Personal Data

Personal data held by Sistem Alüminyum is retained for periods and by methods proportionate to the purpose of processing. In determining retention, primary consideration is given to the purpose of processing, statutory retention periods and applicable limitation periods.

Where the purpose of processing ceases to exist, or the statutory retention and limitation periods expire, personal data held by Sistem Alüminyum is disposed of using the appropriate method of erasure, destruction or anonymisation.

Personal data that Sistem Alüminyum will use for statistical purposes in the future is anonymised so that the data subject cannot be identified in any way as a result of the method applied.

Rights of Data Subjects Under Law No 6698

Any person whose personal data is processed by Sistem Alüminyum, or who believes that their personal data is being processed, may submit a request using the contact details set out under "Identity of the Data Controller", in person, through a notary public, by registered post with acknowledgement of receipt, or by email bearing an electronic signature.

Data subjects have the following rights in respect of their personal data:

To learn whether their personal data is being processed.
To request information about the processing of their personal data, where it has been processed.
To learn the purpose of processing their personal data and whether it is used in accordance with that purpose.
To learn the third parties to whom their personal data is transferred within Türkiye or abroad.
To request rectification of incomplete or inaccurate personal data and notification of such rectification to third parties to whom the personal data has been transferred.
To request erasure or destruction of personal data where the reasons requiring its processing no longer exist, even where it has been processed in accordance with the Law and other applicable legal provisions, and to request notification of such erasure or destruction to third parties to whom the personal data has been transferred.
To object to an outcome to their detriment arising from the analysis of their personal data exclusively by automated systems.
To request compensation for damage suffered as a result of the unlawful processing of their personal data.