Data controller: OTOS TECH Mühendislik Sanayi A.Ş.
Address: Şekerpınar Mahallesi, Geri Dönüşümcüler Sitesi, Ayçiçek Sokak No: 29, Çayırova / KOCAELİ
Email: information@otostech.com
Website: www.otostech.com
We, OTOS TECH Mühendislik Sanayi A.Ş. (“Otostech” or the “Company”), provide this notice to inform you about the personal data we process as a data controller under the Personal Data Protection Law No. 6698 (the “Law”). This notice explains the data processed, the purposes and legal bases for processing, the methods of collection, the groups of recipients to whom data is transferred, retention principles and your rights.
This notice covers employees and interns; job and internship applicants; individual representatives and employees of customers, suppliers, subcontractors and business partners; visitors; individuals who contact us; members of the press; shareholders; board members; and public officials who interact with the Company in the course of their duties. The provisions applicable to you depend on the nature of your relationship with Otostech; not all data listed below is processed for every individual.
This notice is not a statement of explicit consent. Where processing requires explicit consent, consent is obtained through a process separate from the provision of information. Details of specific processes, such as employment, CCTV, internet access or cookies, are explained in notices specific to those processes when the relevant data is collected.
1 What Personal Data Is Processed and for What Purposes and Legal Bases
Your personal data is collected in the processes below by wholly or partly automated electronic means, or by non-automated means through physical documents, provided that they form part of a data filing system. Data is limited to what is necessary for the relevant activity.
1.1 Job and Internship Applicants
Applications and assessment: Your first and last name, telephone number, email address, the position applied for, CV, education, professional experience, technical skills, certifications and foreign language skills, together with interview and assessment records, are processed to review your application, assess your suitability for the position and contact you. For internship applications, your school, department, year of study, type of internship and planned internship dates are also assessed. The legal basis is the necessity of processing directly related to entering into a contract (Article 5(2)(c) of the Law).
Method of collection: Data is obtained through application forms, CVs, email, in-person or online interviews, and employment platforms through which you submit your application to the Company. Marital status, family information, copies of identity documents, or information about litigation or enforcement proceedings that is not required for the role is not requested at the application stage.
1.2 Employees and Interns
Employment and internships: Identity and contact details; contract, role and job title information; employment start and end dates; working time and leave records; salary and bank account details; and training and professional qualifications are processed to perform employment or internship contracts, pay remuneration and organise work (Article 5(2)(c)). Payroll, tax, social security and statutory personnel records are processed to comply with applicable employment, social security and tax obligations (Article 5(2)(a) and (ç)). Records of legal claims and disputes are retained to establish, exercise or protect rights (Article 5(2)(e)).
Method of collection: Information is obtained from documents provided by the employee or intern, contracts, human resources records, training and work records, and notifications from authorised bodies. Details of data, purposes, transfers and retention for each subprocess are provided separately when employment or an internship begins and when the relevant process starts. Former employees and interns may also exercise their rights using the methods in Section 5.
Special categories of personal data: Health information necessary to meet fitness-for-work, occupational health and safety or social security obligations is processed under Article 6(3)(f) of the Law. Medical assessments and preventive healthcare activities conducted by the occupational physician are carried out subject to professional confidentiality and the conditions in Article 6(3)(e). Access to medical details is restricted to authorised persons. For other special categories of personal data, the relevant data and specific legal condition are determined separately; general consent or an employment contract does not provide a basis for processing all special categories of personal data.
1.3 Customers and Their Representatives and Employees
Quotations and project management: First and last name, role, company information, business telephone number and email address are used for communications concerning quotations, orders, project coordination, engineering and design discussions, model and mould production, composite manufacturing, machining, quality control, delivery and after-sales support. Data directly related to a contract with an individual customer is processed under Article 5(2)(c). Business contact details of corporate customer representatives are processed under Article 5(2)(f), based on the legitimate interest in managing the commercial relationship.
Invoicing and requests: Identity and signature information in contracts and authorisation documents, invoicing and payment information relating to individuals, and necessary bank and tax information are processed to perform contracts and meet financial obligations (Article 5(2)(c), (a) and (ç)). Complaint, warranty, acceptance and dispute records are processed to resolve requests and protect rights (Article 5(2)(c) and (e)). Corporate project documents are treated as personal data only to the extent that they can be linked to an individual.
Method of collection: Data is collected through requests for quotations, contracts, order and delivery documents, business correspondence, email, telephone conversations, meetings and notifications from the company represented by the individual. Collecting information by telephone does not mean that calls are audio-recorded.
1.4 Suppliers Subcontractors and Business Partners
Representatives and contact persons: First and last name, role and job title, business contact details, signature and representation authority information are processed for supplier assessment, purchasing, service procurement, and project and delivery coordination. Article 5(2)(c) applies where an individual is a party to the contract; Article 5(2)(f) applies to representatives and employees of legal entities, based on the legitimate interest in managing the business relationship. Invoicing, banking and tax records relating to individuals are processed for payments and financial obligations under Article 5(2)(c), (a) and (ç).
Personnel working at the facility: First and last name, employer, role, assignment dates, facility entry and exit records, and necessary professional qualification and occupational safety training certificates are processed for authorisation, facility security and coordination of on-site work (Article 5(2)(f)). Social security and occupational health and safety documents required by legislation are processed only to the extent necessary for the Company to meet its legal obligations (Article 5(2)(a) and (ç)). For documents containing health information, the condition in Article 6(3)(f) and special security measures apply.
Method of collection: Data is collected through contracts and order documents, authorisation and qualification documents provided by the individual or their employer, assignment lists, facility entry records, email, meetings and business correspondence. Complete personnel files held by the employers of supplier or subcontractor personnel are not requested.
1.5 Website Visitors and Individuals Who Contact Us
Enquiries and quotation requests: Your first and last name, company and role information, email address, telephone number, message and attachments relevant to your request, submitted through the contact form or by email, are processed to answer your enquiry, prepare a quotation and follow up your request. Article 5(2)(c) applies to requests by individuals aimed at entering into a contract; other business communications are processed under Article 5(2)(f), based on the legitimate interest in conducting those communications. Records concerning the exercise of rights and complaints are also processed under Article 5(2)(e).
Technical security: IP addresses, request dates and times, pages accessed and error logs generated when you access the website are processed on the basis of legitimate interests to ensure the website’s secure operation, detect misuse and resolve technical problems (Article 5(2)(f)). Records are limited to what is necessary for this purpose.
Cookies: The Website uses only the ASP.NET SessionId session cookie, which is necessary for its essential operation and session continuity. No cookies are used for language preferences, analytics, advertising or marketing. The cookie provider, purpose, duration and legal basis are explained in the Otostech Cookie Policy. Submitting a contact form is not interpreted as marketing permission or explicit consent.
1.6 Facility and Office Visitors
Visitor records: First and last name, the organisation represented, the person or department visited, visit time and vehicle registration number where entering by vehicle are processed to organise visits, verify entry authorisation and ensure facility security. The legal basis is the legitimate interest in ensuring physical security, provided that individuals’ fundamental rights are not harmed (Article 5(2)(f)). Data is collected through information provided by visitors, appointment records and records at entry points. Copies of identity documents or detailed civil registry information that are not needed for identity verification are not collected.
CCTV and visitor internet access: In areas covered by CCTV, the scope, purpose, legal basis, retention period and recipients of image data are explained in the CCTV privacy notice provided at the entrance. Where visitor internet access is available, the access records retained and applicable legal obligations are explained in a separate notice provided before connection. This notice does not imply that such processing takes place at locations where CCTV or internet services are not provided.
1.7 Members of the Press and Event Participants
Corporate communications: The first and last name, organisation, role, business contact details and participation information of press representatives or event contact persons are processed on the basis of legitimate interests to respond to press enquiries and organise meetings, trade fairs or events in which participation has been requested (Article 5(2)(f)). Information is obtained directly from the individual, business correspondence, and application or participation records.
Use of images for publicity: Where required, explicit consent is obtained for using photographs or videos in which an individual is identifiable for corporate publicity, with separate information on the publication channels and purposes (Article 5(1)). Such use is not a mandatory condition of event participation. The consent and opt-out requirements of the relevant legislation also apply to commercial electronic communications.
1.8 Other Applicants and Public Officials
First and last name, contact details, role, signature, request content and relevant document information obtained in connection with requests, complaints or official procedures are processed to review requests, correspond with competent authorities, and conduct audits and legal procedures. Article 5(2)(ç) applies to statutory application, notification and audit duties; Article 5(2)(e) applies to establishing and protecting rights; and Article 5(2)(f) applies to other corporate communications. Data is obtained through petitions, official correspondence, reports, email, telephone and documents provided by the individual.
1.9 Shareholders Partners and Board Members
Identity, contact, signature, representation and role information is processed for shareholding, general meeting, board, trade registry and statutory notification procedures. Personal payment and bank information is used to make payments due and fulfil financial obligations. The legal bases are processing expressly provided for by commercial and tax legislation and compliance with legal obligations (Article 5(2)(a) and (ç)); Article 5(2)(e) applies to dispute records. Data is obtained from the individual’s statements, shareholding and resolution records, official documents and notifications from authorised bodies. Detailed information specific to this relationship is provided during the relevant procedure.
2 To Whom Personal Data Is Transferred and for What Purposes
2.1 Recipients in Türkiye
Personal data is transferred to the following groups of recipients, limited to the data required by the relevant process and subject to the conditions in Article 8 of the Law:
· Authorised public bodies, courts and enforcement authorities: Relevant identity, transaction, financial and employment records for statutory notifications, tax, social security, audits and legal requests.
· Banks and payment service providers: Identity, account and transaction information necessary for salary payments, supplier payments and collections.
· Accounting, financial advisory, legal and independent audit service providers: Identity, contact, financial and dispute information necessary to prepare financial records, manage legal processes and carry out the relevant audit.
· IT, hosting, corporate communications and technical support service providers: Data within the scope of the service for operating the relevant information system, ensuring its security and providing technical support; access rights are limited to the assigned duties.
· Transport, courier and logistics service providers: The name, business contact details and delivery address of the recipient or contact person for delivery purposes.
· Customers, suppliers, subcontractors and business partners: The names, titles and business contact details of assigned personnel, together with authorisation and qualification information required for the relevant project, task coordination and delivery acceptance procedures.
· Occupational physicians and authorised occupational health and safety service providers: Employee and assignment information necessary for statutory health surveillance and occupational safety obligations; the conditions in Article 6 of the Law and adequate safeguards also apply to health data.
The legal basis for a transfer is the condition specified in Section 1 for the relevant activity. A transfer to a service provider does not, by itself, authorise unlimited use or processing for other purposes. This notice does not provide for transfers to group companies or subsidiaries solely because a group relationship exists.
3 How Long Personal Data Is Retained
Personal data is retained for the periods specified in the relevant legislation or, where no such period is specified, only for as long as required by the specific purpose of processing. When that purpose ends, data is erased, destroyed or anonymised unless there is an ongoing statutory retention obligation or a need to establish, exercise or protect a right.
Applicable statutory periods are used for financial, commercial and employment records; the recruitment process and, where applicable, a candidate pool retention period established through separate consent are used for applications; and the period required by the relevant activity is used for communication and visitor records. Retention periods for CCTV and technical access records are explained in notices specific to the relevant system. Records that must be retained because of a dispute are kept only to the extent and for the period necessary for the relevant legal claim.
If consent is withdrawn, consent-based processing stops unless another legal basis exists. Records subject to an ongoing statutory retention obligation are retained without being used for other purposes; backups are also included in the applicable disposal schedule.
4 Your Rights Regarding Your Personal Data
Under Article 11 of the Law, you may learn whether your data is processed, request information if it has been processed, enquire about the purpose of processing and whether the data is used in line with that purpose, learn about recipients in Türkiye and abroad, request rectification of incomplete or inaccurate data, and request erasure or destruction where the legal conditions are met. You may request that third parties to whom data has been transferred be notified of rectification and erasure, object to an outcome that is adverse to you resulting solely from automated analysis, and request compensation for damage caused by unlawful processing.
5 How to Exercise Your Rights
You may submit your request to OTOS TECH Mühendislik Sanayi A.Ş. using the following methods:
· Written request: You may deliver your signed request in person or by post to Şekerpınar Mahallesi, Geri Dönüşümcüler Sitesi, Ayçiçek Sokak No: 29, Çayırova / KOCAELİ.
· Email: You may send your request to information@otostech.com from an email address previously provided to the Company and registered in its system. You may also send requests signed with a secure electronic signature or mobile signature to this address.
· Registered electronic mail: You may submit your request to otostech@hs01.kep.tr from your own registered electronic mail (KEP) address.
Your request must include your first and last name; your signature for a written request; your Turkish identity number if you are a Turkish citizen, or your nationality and passport number or, where available, identity number if you are a foreign national; your address for service; your email address, telephone and fax details for notifications, where available; and your request. Relevant information and documents must be attached. Use of a specific form is not mandatory.
Necessary and proportionate additional information may be requested to verify securely that the request belongs to you; submitting a copy of an identity document is not required for every request. If you apply through a representative, a document showing their authority must be attached. Using “KVKK Başvurusu” (“PDPL Request”) in the subject line will help route your request.
6 When Your Request Will Be Answered
Your request will be concluded as soon as possible, depending on its nature, and no later than 30 days after it is received by the Company. The request will be accepted or rejected with reasons, and the response will be sent to you in writing or electronically.
Requests are generally free of charge. If processing incurs an additional cost, only the fee specified in the tariff set by the Personal Data Protection Board may be charged. If the request results from an error by the Company, any fee charged will be refunded.