1. INTRODUCTION
1.1. PURPOSE AND SCOPE OF THE POLICY
Pursuant to Article 20 of the Constitution of the Republic of Türkiye, everyone has the right to request the protection of personal data concerning them.
The Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) was enacted to protect the fundamental rights and freedoms of individuals, in particular the privacy of private life, in the processing of personal data and to regulate the obligations, procedures and principles to be followed by natural and legal persons processing personal data.
This BODE Araç Kapı Sistemleri Sanayi ve Ticaret A.Ş. (“COMPANY”) Policy on the Protection of Special Categories of Personal Data (“Policy”) has been prepared to establish the principles for the lawful processing and protection of special categories of personal data processed by the COMPANY, and for the systematic, manageable and sustainable implementation of the technical and administrative measures relating to such data.
POLICY; covers the processes relating to the collection, recording, use, access, retention, transfer, security and destruction of special categories of personal data processed by the COMPANY, as well as COMPANY employees, authorized users, service providers and other relevant persons involved in these processes.
All bodies and departments of the COMPANY, as well as employees who have duties and authorization in special-category personal data processing activities, are obliged to act in accordance with the provisions of this POLICY and to cooperate with the person/unit responsible for KVKK processes.
1.2. ENTRY INTO FORCE AND AMENDMENTS
POLICY is made available to the public by the COMPANY through publication on its website. In the event of any conflict between applicable legislation, particularly the KVKK, and the provisions of this POLICY, the provisions of the applicable legislation shall prevail.
COMPANY may update the POLICY in line with changes in legislation, decisions of the Personal Data Protection Board and changes that may occur in personal data processing activities. The current version of the POLICY can be accessed via the COMPANY website.
2. SPECIAL CATEGORIES OF PERSONAL DATA
Pursuant to Article 6 of the KVKK, data concerning an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data constitute special categories of personal data. Special categories of personal data are defined in the Law by exhaustive enumeration, and these categories cannot be expanded by analogy.
COMPANY processes special categories of personal data to the extent required by its activities and within the processes specified in the Personal Data Processing Inventory. Special categories of personal data that are not necessary for the processing purpose shall not be requested or processed.
COMPANY determines the data categories, groups of data subjects, processing purposes, legal bases, retention periods and transfer information relating to special categories of personal data it processes in the “Personal Data Processing Inventory” and the relevant information notices.
2.1. INFORMATION OF DATA SUBJECTS WHEN SPECIAL CATEGORIES OF PERSONAL DATA ARE COLLECTED
Pursuant to Article 10 of the KVKK, data subjects are informed by the data controller or persons authorized by it when personal data is collected. COMPANY, when fulfilling its information obligation, informs data subjects at a minimum about the matters such as:
A. The identity of the data controller and, where applicable, its representative
B. The purposes for which personal data will be processed
C. To whom and for what purposes processed personal data may be transferred
D. The method and legal basis of collecting personal data
E. The rights of the data subject specified in Article 11 of the KVKK and how these rights may be exercised
The information obligation and data processing activities requiring explicit consent are conducted as separate legal processes.
Where special categories of personal data may be processed on the basis of a processing condition regulated under Article 6 of the KVKK other than explicit consent, explicit consent is not additionally requested.
2.2. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
Special categories of personal data may be processed where one of these conditions is met:
A. The data subject has given explicit consent
B. Processing is expressly provided for by law
C. Processing is necessary for the protection of the life or physical integrity of the person, or of another person, who is unable to express consent due to actual impossibility or whose consent is not legally valid
D. Processing relates to personal data made public by the data subject and is consistent with the intention to make such data public
E. Processing is necessary for the establishment, exercise or protection of a right
F. Processing is necessary, by persons subject to an obligation of confidentiality or by authorized institutions and organizations, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services
G. Processing is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance
H. Processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade-union purposes, provided that it complies with the legislation to which they are subject and their purposes, is limited to their fields of activity and is not disclosed to third parties, and relates to their current or former members or persons who are in regular contact with such organizations and formations
Special categories of personal data are processed provided that at least one of the processing conditions specified in Article 6 of the KVKK is met and adequate measures determined by the Personal Data Protection Board are taken.
COMPANY processes special categories of personal data only on the legal basis applicable to the relevant data processing activity, and in a manner limited and proportionate to the specified purpose.
Where the relevant data processing activity can be based on a processing condition other than explicit consent under Article 6 of the KVKK, explicit consent is not additionally requested. Where explicit consent constitutes the legal basis, such consent must relate to a specific matter, be based on information and be given freely.
2.3. PRINCIPLES ADOPTED
COMPANY acts in accordance with the fundamental principles regulated under Article 4 of the KVKK when processing special categories of personal data. In this context, personal data are processed and retained in accordance with the following criteria:
A. Processed lawfully and fairly
B. Accurate and, where necessary, kept up to date
C. Processed for specified, explicit and legitimate purposes
D. Relevant, limited and proportionate to the purposes for which it is processed
E. Retained for the period prescribed by the relevant legislation or required for the purpose for which it is processed
Data minimization is one of the fundamental principles in processing special categories of personal data. Special categories of personal data that are not necessary for the processing purpose are not requested; if obtained by any means, the necessary actions are taken in accordance with applicable legislation and the retention and destruction rules of the COMPANY. Access to special categories of personal data is restricted to persons whose duties and authorization require such access.
2.4. TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA
COMPANY may transfer special categories of personal data to third parties only where specified, explicit and lawful purposes exist and the applicable KVKK processing and transfer conditions are met.
For domestic transfers, Article 8 of the KVKK and, depending on the nature of the special-category personal data, the conditions set out in Article 6 of the KVKK and the adequate measures determined by the Board are taken into consideration.
THE COMPANY DOES NOT TRANSFER SPECIAL CATEGORIES OF PERSONAL DATA ABROAD.
If, as a result of a change in the COMPANY information systems, service providers, storage or backup infrastructure, the transfer of special categories of personal data abroad becomes relevant, the necessary legal and technical assessment is carried out under Article 9 of the KVKK before the transfer activity is put into operation; the “Personal Data Processing Inventory”, relevant information notices and other necessary documents are updated.
3. PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA
COMPANY, within the scope of Article 12 of the KVKK, takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data and ensure the secure retention of personal data.
In the processing of special categories of personal data, in addition to general personal data security measures, the adequate measures determined by the Personal Data Protection Board in its Decision dated 31.01.2018 and numbered 2018/10 are applied. The Board Decision also requires the establishment of a systematic and sustainable policy/procedure specifically for special categories of data.
COMPANY monitors special-category personal data processing processes and the security measures implemented on a risk-based basis; controls and audits are performed where deemed necessary.
3.1. MEASURES FOR EMPLOYEES AND AUTHORIZED USERS INVOLVED IN THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
Employees involved in the processing of special categories of personal data are subject to the following measures:
A. Regular training is provided on the KVKK, relevant legislation and the security of special categories of personal data.
B. Confidentiality obligations are imposed and the necessary confidentiality agreements/undertakings are established.
C. The scope and duration of authorization of users who have access rights to the data are clearly defined.
D. Access authorizations are periodically reviewed.
E. Access rights to special categories of personal data of employees whose duties change or whose employment ends are revoked without delay; data-bearing devices, media and other corporate assets allocated to them are taken back.
F. Authorization is based on the need-to-access and least-privilege principles; employees are not granted broader access to special categories of personal data than is necessary for their duties.
G. Unauthorized copying or transfer of special categories of personal data, storage on personal devices or accounts, or use outside the purpose of the duty is prohibited.
3.2. MEASURES FOR ELECTRONIC ENVIRONMENTS WHERE SPECIAL CATEGORIES OF PERSONAL DATA ARE PROCESSED, STORED AND/OR ACCESSED
In systems where special categories of personal data are processed, stored or accessed electronically:
A. Data is protected using appropriate cryptographic methods to the extent applicable
B. Cryptographic keys are kept securely and, where necessary, in environments separate from the data
C. Records relating to access to and operations performed on the data are securely logged
D. Security updates relating to environments containing the data are continuously monitored; necessary security tests are regularly carried out or commissioned and the test results are recorded.
E. Where special categories of personal data are accessed through software or an information system, user authorizations are implemented; security tests of the relevant systems and software are regularly performed and the results are recorded.
F. Where remote access to special categories of personal data is necessary, at least two-factor authentication is applied.
G. User accounts are not shared; access rights are assigned on an individual basis and access is restricted to the scope of duties/authorization.
3.3. MEASURES FOR PHYSICAL ENVIRONMENTS WHERE SPECIAL CATEGORIES OF PERSONAL DATA ARE PROCESSED, STORED AND/OR ACCESSED
Where special categories of personal data are processed or stored in physical environments:
A. Necessary physical and environmental security measures are taken against electrical leakage, fire, flooding, theft and similar risks, as appropriate to the nature of the environment in which the data is located
B. The physical security of environments containing the data is ensured.
C. Access to physical environments containing special categories of personal data is subject to authorization and unauthorized entry and exit are prevented.
D. Appropriate storage and access measures are implemented to prevent special categories of personal data in paper form from being viewed, taken or copied by unauthorized persons.
3.4. SECURITY MEASURES FOR THE TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA
Where the transfer of special categories of personal data is necessary:
A. If data must be transferred by e-mail, the transfer is carried out using secure and appropriate encryption methods via a corporate e-mail account or Registered Electronic Mail (KEP).
B. Where the use of portable memory, CD, DVD or similar physical data carriers is mandatory, the data is encrypted using cryptographic methods and the cryptographic key is kept in a separate and secure environment.
C. Where data is transferred between servers in different physical environments, secure data transfer methods such as VPN or sFTP are used.
D. Where data must be transferred in paper form, necessary measures are taken against the risks of loss, theft or viewing by unauthorized persons, and the documents are sent in a manner appropriate to their classification as confidential documents.
E. Transfers are limited to persons for whom they are necessary in terms of duty and purpose, and to the necessary scope of data.
4. RETENTION AND DESTRUCTION OF SPECIAL CATEGORIES OF PERSONAL DATA
Special categories of personal data are retained for the periods prescribed in applicable legislation and for as long as the purposes requiring the processing of personal data continue, limited to the retention periods determined in the COMPANY’s Personal Data Processing Inventory and Personal Data Retention and Destruction Policy.
When determining the retention period, Article 4 of the KVKK and the principle of “retaining personal data for the period prescribed by the relevant legislation or required for the purpose for which they are processed” are taken as the basis.
Where the legal grounds requiring the processing of special categories of personal data cease to exist and there is no other legal obligation requiring the data to be retained, such data is, in accordance with Article 7 of the KVKK and the COMPANY “Personal Data Retention and Destruction Policy”, deleted, destroyed or anonymized.
When destroying documents or records containing special categories of personal data, appropriate destruction methods are used to prevent the data from being re-obtained or becoming accessible by unauthorized persons.
5. AUTHORIZATION, AUDIT AND RESPONSIBILITY
Access rights to special categories of personal data are determined within the scope of the Authorization Matrix and relevant information security rules, taking into account employees’ duties and responsibilities.
Access rights are reviewed when necessary and periodically. In the event of a change of duty, change of authorization or termination of employment, the necessary access changes are implemented without delay.
The implementation of technical and administrative measures relating to the processing of special categories of personal data is the responsibility of the relevant process owners and authorized employees. The person/unit responsible for KVKK processes coordinates the implementation of this Policy.
Employees who identify a situation contrary to the provisions of the POLICY, information security rules or personal data security shall report the situation without delay to the relevant manager of the COMPANY and/or the person/unit responsible for KVKK processes.
COMPANY reviews its special-category personal data processing activities and the measures taken in line with changes in risk, legislation, processes or information systems and implements the necessary improvements.
6. UPDATING THE POLICY
This POLICY may be reviewed and updated in line with changes in legislation, decisions of the Personal Data Protection Board, changes in the COMPANY’s special-category personal data processing activities, changes in information systems or organizational structure, and other legal or operational requirements.
The current version of the POLICY is published on the COMPANY website. If an update to the POLICY results in a change in personal data processing that requires data subjects to be separately informed, the relevant information obligation shall also be fulfilled.