Personal Data Protection and Processing Policy

ARTICLE 1- PURPOSE 

Baymineral Maden ve Kimya Sanayi Dış Ticaret Limited Şirketi ("Baymineral") undertakes to comply with personal data protection, processing and destruction regulations in accordance with its social and legal responsibilities. This Personal Data Protection and Processing Policy ("Policy") is applied to all of Baymineral within the framework of the applicable legislation and is based on nationally accepted basic principles regarding personal data destruction. It includes the framework and principles for carrying out the necessary destruction procedures within the scope of the relevant legislation.

The third paragraph of Article 7 of the Law on the Protection of Personal Data ("Law" or “KVKK”) stipulates that "The procedures and principles regarding the deletion, destruction or anonymization of personal data shall be regulated by regulation". Based on this provision and subparagraph (e) of the first paragraph of Article 22 of the Law, the Personal Data Protection Board ("Board") prepared the Regulation on Deletion, Destruction or Anonymization of Personal Data ("Regulation") and published it in the Official Gazette dated October 28, 2017 and numbered 30224.

Based on the above regulation, the purpose of this Policy is to determine the procedures and principles regarding the deletion, destruction or anonymization of personal data collected by Baymineral in the conduct of its activities in accordance with the Regulation.

ARTICLE 2- SCOPE

This Policy relates to the personal data of employees, employee candidates, visitors, third parties (including but not limited to agents and brokers) and third parties' employees working at Baymineral, which are processed in whole or in part automatically or non-automatically provided that they are part of any data recording system, and the storage and destruction of this data.

ARTICLE 3- DEFINITIONS

Recipient Group: The category of natural or legal person to whom personal data is transferred by the data controller.

Explicit Consent: Consent on a specific issue, based on information and expressed with free will.

Electronic Media: Media in which personal data can be created, read, modified and written with electronic devices.

Non-Electronic Media: All written, printed, visual, etc. other than electronic media. environments.

Relevant Person: The natural person whose personal data is processed. Destruction: Deletion, destruction or anonymization of personal data. Law/KVKK: Law No. 6698 on the Protection of Personal Data.

Recording Medium: Any medium in which personal data processed by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system.

Board: Personal Data Protection Board

Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are sensitive personal data.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller.

Data Recording System: It is the recording system where personal data is structured and processed according to certain criteria.

Data Controller: The person who determines the purposes and means of processing personal data and manages the place where the data is kept systematically (data recording system) is the data controller.

Deletion of Personal Data: Deletion of personal data; making personal data inaccessible and non- reusable in any way for the Relevant Users.

Destruction of Personal Data: The process of making personal data inaccessible, unrecoverable and unusable by anyone in any way.

Destruction of Personal Data: Deletion, destruction or anonymization of personal data.

Anonymization: Rendering the data previously associated with a person unlikely to be associated with an identified or identifiable natural person under any circumstances, even by matching it with other data.

ARTICLE 4- RECORDING MEDIUM

Personal Data is securely stored by Baymineral in accordance with the law in the environments listed below.

 

 

ARTICLE 5- ISSUES REGARDING THE PERSONAL DATA PROCESSING POLICY

5.1.  General Principles for Processing Personal Data

Baymineral processes and protects the personal data of Users within the scope of the Constitution of the Republic of Turkey and the Law on the Protection of Personal Data.

In this context, Baymineral acts in line with the following principles:

• As a prudent merchant, it acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty in the processing of personal data,

• It ensures that the personal data it processes is accurate and up-to-date, taking into account the fundamental rights and legitimate interests of personal data owners within the scope of the Law on the Protection of Personal Data, together with other laws that it must comply with within the scope of its activities,

• It clearly and precisely determines the legitimate and lawful purpose of personal data processing. In this context, personal data is processed limited to the services provided or to be provided and legal obligations. The purpose for which personal data will be processed is determined before the personal data processing activity begins,

• It processes personal data in a manner that is conducive to the realization of the specified purposes and avoids the processing of personal data that is not related to the realization of the purpose or is not needed,

• It retains personal data only for the period specified in the relevant legislation that it is obliged to comply with or for the period required for the purpose for which they are processed.

5.2.  Terms of Processing of Personal Data

Protection of personal data is a constitutional right. Fundamental rights and freedoms may be restricted without prejudice to their essence only for the reasons set out in the relevant articles of the Constitution and only by law. Pursuant to the Constitution, personal data may only be processed in cases stipulated by law or with the consent of the individual.

In this direction and in accordance with the Constitution, Baymineral processes personal data only in cases stipulated by law or with the explicit consent of the data subject. The explicit consent of the personal data subject is only one of the legal grounds that make it possible to process personal data in accordance with the law.

Apart from explicit consent, personal data may also be processed in the presence of one of the other conditions listed below. The basis of the personal data processing activity may be only one of the following conditions, or more than one of these conditions may be the basis of the same personal data processing activity.

• The personal data of the data subject may be processed in accordance with the law without obtaining his/her explicit consent, if expressly provided for in the law.

• The personal data of the data subject may be processed if it is mandatory to process the personal data of the person who is unable to disclose his/her consent due to actual impossibility or whose consent cannot be recognized as valid in order to protect his/her or another person's life or physical integrity.

• Provided that it is directly related to the establishment or performance of a contract, it is possible to process personal data if it is necessary to process personal data belonging to the parties to the contract.

• If the personal data is made public by the data subject himself/herself, the relevant personal data may be processed.

• If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.

Baymineral sensitively complies with the regulations stipulated in the Personal Data Protection Law in the processing of personal data determined as "special quality" by the Personal Data Protection Law.

In Article 6 of the Law on the Protection of Personal Data, certain personal data which, when  processed unlawfully, carries the risk of causing victimization or discrimination of persons, are defined as "special categories".

These data include data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

In accordance with the Law on the Protection of Personal Data, special categories of personal data are processed by Baymineral in the following cases, provided that adequate measures to be determined by the Personal Data Protection Board are taken:

If the personal data owner has explicit consent or if the personal data owner does not have explicit consent; personal data of special nature other than the health and sexual life of the personal data owner are processed in cases stipulated by law, and personal data of special nature related to the health and sexual life of the personal data owner are processed only by persons or authorized institutions and organizations under the obligation of confidentiality for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, personal data shall be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the data subject if the reasons requiring its processing disappear.

When the retention periods stipulated in the relevant legislation or required by the purpose of processing expire, during the 6-month period stipulated for periodic destruction; Baymineral deletes or anonymizes the personal data it processes by using one or more of the deletion and anonymization methods specified in the guide on Deletion, Destruction or Anonymization of Personal Data published by the KVK Board, using one or more techniques that are most suitable for business processes and activities.

ARTICLE 6- DISCLOSURE OBLIGATION

According to the Constitution of the Republic of Turkey, everyone has the right to be informed about personal data concerning him/her. Accordingly, Article 11 of the Law on the Protection of Personal Data lists "requesting information" among the rights of the personal data subject.

In this context, Baymineral provides the necessary information in case the personal data owner requests information in accordance with the Constitution and KVKK.

In accordance with Article 10 of the LPPD, Baymineral also informs personal data subjects about the purpose for which personal data will be processed during the acquisition of personal data, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data and the rights of the personal data subject under Article 11 of the LPPD.

In addition, Baymineral ensures informing and transparency in personal data processing activities by announcing to personal data owners and those concerned that it carries out personal data processing activities in accordance with all matters in the KVKK and the "law and honesty rule" through various public documents, especially this Policy.

ARTICLE 7- TRANSFER OF PERSONAL DATA 

Personal data held by Baymineral are securely stored and not disclosed to third parties outside the legal framework. Baymineral, persons, institutions and/or organizations, business partners, all authorities and channels required for the execution of the User Agreement, public legal entities authorized to receive personal data such as Courts, Public Prosecutor's Offices, SSI, BRSA, BRSA, CMB, MASAK, BKM, authorities, our domestic / foreign affiliates; to companies operating in the capacity of intermediary/agency, to third parties from and to whom services are received and provided in order to carry out company activities, to cooperating and program partner institutions, organizations, domestic/foreign banks, funds, cooperating organizations, domestic/foreign/international organizations from which service/support/consultancy is received or project/program/financing partner and independent audit and support services are received due to legal obligations but within the framework of legal limitations.

ARTICLE 8- RIGHTS OF THE DATA SUBJECT PURSUANT TO ARTICLE 11 OF THE KVKK NUMBERED 6698

Pursuant to Article 11 of the KVKK No. 6698, personal data owners are entitled to

• Learn whether personal data is being processed,

• Request information if their personal data has been processed,

• To learn the purpose of processing personal data and whether they are used for their intended purpose,

• To know the third parties to whom personal data is transferred domestically or abroad,

• To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,

• Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,

• To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,

• In case of damage due to processing in violation of the KVKK, requesting the compensation of the damage.

ARTICLE 9- DATA CONTROLLER UNDER THE LAW

In order to exercise your rights set forth in Article 11 of the LPPD, you may contact Baymineral in writing or through other means determined by the Personal Data Protection Board by using the contact information specified below.

Correspondence Address:

Baymineral Maden ve Kimya San. Dış Tic. Ltd. Şti.

Cevizli Mah. Tugay Yolu Cad. No:69A İç Kapı No: 191 Maltepe, Istanbul Call Phone: 0(216) 706 29 60

E-mail: kvkk@baymineral.com

ARTICLE 10- FINAL PROVISIONS

In case of incompatibility between the provisions of the KVKK and other relevant legislation and this Policy, the provisions of the KVKK and other relevant legislation will be applied first.

Baymineral may change the content of this Policy whenever it deems necessary. The updated Policy will enter into force on the date of publication. The last update date is at the end of the text.

In the event of any dispute, Baymineral's records alone shall prevail and bind the parties.

Last updated: 29/05/2024