KVKK Text

KVKK Text of VIPNET&SMT Enerji Information Notice by SMT Enerji on the Protection of Personal Data,

This information notice has been prepared by VIPNET&SMT in its capacity as data controller within the scope of Article 10 of the Law No. 6698 on the Protection of Personal Data (“Law”) and the Communiqué on Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform.

1.Data Controller

Employee, Employee Candidate, Property Owner, Intern, Supplier Employee, Supplier Representative, Individuals Receiving Products or Services, and Visitors’ personal data in the categories reported to the verbis system are processed, taking into account privacy issues related to the privacy of private life. In accordance with the Law, the scope of processing by VIPNET&SMT in its capacity as data controller is explained in this information notice (“Information Notice”).

2.What is the Method and Legal Basis for Collection of Personal Data?

Personal data, including sensitive personal data such as health information, is obtained either fully or partially automatically or non-automatically through completely or partially automated systems or any data recording system as part of VIPNET&SMT, either directly from the data subject, from systems capable of determining location, or from the authorized personnel of the company where supplier employees work. In accordance with the basic principles stipulated by the Law, personal data may be processed and transferred at home and abroad for the following purposes with the natural and legal persons specified in this Information Notice within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

3.What are the Cases in which the Data Controller Can Process Personal Data without Explicit Consent Under the Law?

Pursuant to Article 5 of the Law, VIPNET&SMT may process the personal data it has received in accordance with the law without seeking explicit consent in the following cases:

Where expressly provided for by law,
Due to actual impossibility to obtain the explicit consent of the Data Subject, or in cases where consent is not legally valid, the processing of personal data becomes necessary for the protection of the life or physical integrity of the Data Subject or another person,
It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the execution or performance of a contract concluded between VIPNET&SMT and the Data Subject,
It is mandatory for VIPNET&SMT to fulfill a legal obligation,
Personal data is made public by the Data Subject,
Where data processing is mandatory for the establishment, exercise or protection of a right,
It is necessary to process the data for the legitimate interests of VIPNET&SMT, provided that it will not harm fundamental rights and freedoms.

Besides, in accordance with Article 6 of the Law, VIPNET&SMT may process sensitive personal data it has received in accordance with the law without seeking explicit consent in the following cases;

The data related to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures of the persons and the biometric and genetic data are sensitive personal data.
Sensitive personal data other than the health and sexual life of the data subject is stipulated in the laws,
Sensitive personal data related to the health and sexual life of the data subject are only available to persons or authorized institutions and organizations under the obligation of confidentiality for the purpose of protection of public health, execution of preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

4.What are the Purposes of Processing Personal Data?

Personal data can be processed for;

Execution of Application Process for Employee Candidates and Internship
Fulfillment of Obligations Arising from Employment Contract and Legislation for Employees
Conducting Benefits and Interests Processes for Employees
Execution of Training Activities
Execution of Access Authorities
Conducting Operations in accordance with the Legislation
Execution of Finance and Accounting Affairs
Ensuring Physical Space Security
Conducting Assignment Processes
Follow-up and Execution of Legal Affairs
Conducting Communication Operations
Planning Human Resources Processes
Conducting / Auditing Business Operations
Execution of Occupational Health & Safety Activities
Execution of Service Procurement Processes
Execution of After-Sales Support Services
Execution of Service Sales Processes
Execution of Performance Evaluation Processes
Execution of Contract Processes
Execution of Wage Policy
Providing Information to Authorized Persons, Institutions and Organizations
Creating and Tracking Visitor Records

by VIPNET&SMT and other natural and/or legal persons specified in Article V.

5.To Whom and for What Purpose Are Personal Data Transferred?

The personal data collected may be transferred to legally authorized public institutions and organizations, as well as natural persons or private legal entities. This includes companies and organizations that will establish employment contracts with VIPNET&SMT, along with their business partners, suppliers, and service providers. The transfer will be carried out in accordance with the basic principles stipulated by the law and for the purposes specified in Articles 8 and 9 of the Law, as well as for the following purposes.

Follow-up and Execution of Legal Affairs
Obtaining permits for personnel to work in the field and Conducting the Assignment Processes
Subscription Initiation and Notification of Payment of Invoices
Ensuring Security of Physical Spaces,
Providing Information to Authorized Persons, Institutions and Organizations
Supply of Phone line
Provision of Access Authorizations to Software of Business Partners
Meeting Tender Participation Requirements
Fulfillment of Legal Obligation
Execution of SSI Notifications
Handling Card Printing
Opening of Corporate User Accounts
Personnel Salary Payments
Execution of Contract Processes
Record of trainee attendance
Creating e-Prescription after diagnosis

VIPNET&SMT may transfer personal data to foreign countries declared to have adequate protection by the PPD Board (“Foreign Country with Adequate Protection”) or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and the relevant foreign country undertake an adequate protection in writing and where the PPD Board has granted permission (“Foreign Country Where the Data Controller Undertakes Adequate Protection”).

6.What are the Rights of Data Subjects?

Within the framework of Article 11 of the Law, the Data Subject is entitled to the following by applying to the data controller at any time;

Learn whether his/her personal data is processed or not,
Request relevant information if his/her personal data has been processed,
Learn the purpose of processing his/her personal data and whether his/her personal data is used as suitable for the purpose,
Know the third parties to whom his/her personal data has been transferred at home or abroad,
Request for correction of his/her personal data if incomplete or incorrectly processed,
Request the deletion or destruction of his/her personal data if the reasons for the processing of his/her personal data are eliminated in order to be evaluated within the principles of purpose, duration and legitimacy,
Request the deletion, destruction or anonymization of his/her personal data if the reasons for the processing are eliminated, despite the fact that they have been processed in accordance with the Law on the Protection of Personal Data No. 6698 and the provisions of other relevant laws,
Request notification of the transactions related to the correction, deletion or destruction of the personal data to the third parties to whom the personal data are transferred,
Object if any result occurs against him/her by analyzing the processed personal data exclusively through automated systems,
Request the compensation of the damage if he/she suffers damage due to the unlawful processing of his/her personal data.

7.How Does the Data Subject Exercise His/Her Rights?

In accordance with Article 11 of the Law, the Data Subject must fill out the application form completely and submit it to VIPNET&SMT through the channels specified in the form to exercise the rights mentioned above.

VIPNET&SMT shall conclude the request free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, VIPNET&SMT reserves the right to receive the fee in the tariff determined by the Personal Data Protection Board.

8.How Long Will Personal Data Be Processed?

In accordance with the Law, personal data processed for the purposes specified in this Information Notice will be deleted, destroyed, or anonymized and continued to be used by VIPNET&SMT when the purpose requiring processing according to Article 7 of the Law ceases to exist, and/or when the statutory retention periods imposed for the processing of data by VIPNET&SMT expire.