Information Notice on the Processing of Personal Data for Employees* and Employee Candidates*
I. Data Controller
This information notice has been prepared, in its capacity as “Data Controller”, within the scope of Article 10 of Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, by Katılım Finans Kefalet A.Ş. (“KFK”), located at “Fatih Sultan Mehmet Mah., Poligon Cad., Buyaka 2 Sitesi No:8, Kule 2 Kat:15 Ümraniye/İSTANBUL”, with Mersis No. 0528153886000001, registered with the Istanbul Trade Registry Office under registration number 452387-2, and registered with the Istanbul-Alemdağ Tax Office under tax identification number 528 153 8860.
II. Purposes for Which Personal Data Will Be Processed
a. For employees
Your personal data are processed for the purposes of: enabling you to fulfil your obligations under your employment contract in order to determine the principles to which your employment is subject within legal limits; planning, organizing, managing and/or executing the activities subject to your employment contract to the extent necessary within legal limits; performing the employment contract; monitoring and auditing work activities; fulfilling legal obligations such as occupational health and safety; conducting pre-employment medical examinations, periodic check-ups and return-to-work examinations; issuing prescriptions; providing occupational health and safety (OHS) training and conducting drills; paying wages and making payments such as payroll, salary, severance, compensation and advances; providing fringe benefits and perquisites; providing work clothing; preparing and organizing shift reports; conducting annual evaluation and resolution activities; salary management; performance evaluation; appointment, promotion, title and resignation processes, or the evaluation of disciplinary matters, dismissal and ethical rules; creating training attendance forms for internal training and evaluating participants in internal training; performance quality audits; granting annual leave; recording and forwarding incoming and outgoing documents; arranging hotel, flight and accommodation bookings; creating user accounts (including e-mail) and installing programs and software on KFK devices; monitoring and recording employees' internet access; creating and keeping entry-exit records (including CCTV); recording calls and conversations on the KFK switchboard system; processing employee garnishment notices and paying amounts notified through garnishment orders; providing work clothing; entering into leasing agreements; allocating vehicles from the vehicle pool; carrying out promotion examinations and related procedures, training and personal career development activities; arranging private health insurance policies; enabling KFK to fulfil the obligations it is required to perform and collecting the health data it is obliged to collect under the relevant legislation; in addition to the foregoing, fulfilling the obligations under the Labour Law in force in the Republic of Türkiye, the social security legislation and other legislation, as well as the obligations KFK is required to comply with in order to ensure occupational health and safety, and providing the information that must be submitted to the competent authorities and institutions as required by law; ensuring the security of KFK's facilities, buildings and fixtures; planning and executing KFK's audit activities and creating employee records in order to maintain human resources operations; monitoring and/or auditing business activities within legal limits; organizing corporate relations; conducting surveys for the management and development of corporate relations such as service quality, measurement of beneficiary satisfaction and complaint management; managing relations with business partners, customers and/or suppliers; and planning and executing KFK's financial risk processes and strategic planning activities.
b. For employee candidates
Your personal data contained in the CV and/or work summary that you have shared/will share with KFK in your job application, and any additional personal data that KFK may request from you if you proceed to the next stages of the candidate evaluation process, are processed for the purposes of: collecting job applications; managing the candidate evaluation process and conducting job suitability analyses; managing the pre-planning process regarding the salary to be offered and the fringe benefits and perquisites to be provided if an employment contract is concluded; retention for carrying out recruitment processes; planning and carrying out personnel operations processes; checking the candidate's suitability for the job; carrying out correspondence activities; recording closed-circuit camera footage for security purposes at KFK premises; recording calls and conversations on the KFK switchboard system; planning and executing business activities and operational processes; managing and developing corporate relations such as complaint management; ensuring legal and commercial security; and conducting legal proceedings to which KFK is a party.
III. Method and Legal Grounds for Collecting Personal Data
Your personal data are collected and stored orally, in writing, physically and/or electronically, in digital form or on paper, through channels such as e-mail, the KFK website, KFK social media accounts, fax, SMS, CCTV, the KFK switchboard system, courts and other official institutions.
Your personal data are processed based on the legal grounds of “being expressly provided for by law” under Article 5/2-(a) of the Law, “processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract” under Article 5/2-(c), “being mandatory for the data controller to fulfil its legal obligation” under Article 5/2-(ç), “data processing being mandatory for the establishment, exercise or protection of a right” under Article 5/2-(e), and “data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” under Article 5/2-(f); and, in cases where these legal grounds cannot be relied upon, on the legal ground of “the explicit consent of the data subject” set out in Article 5/1 of the Law;
Your special categories of personal data other than health and sexual life are processed based on the legal ground of “being provided for by law” set out in Article 6/3 of the Law, and, in cases where this legal ground cannot be relied upon, on the legal ground of “the explicit consent of the data subject” set out in Article 6/2 of the Law;
Your health data are processed based on the legal ground of “the explicit consent of the data subject” set out in Article 6/2 of the Law.
IV. To Whom and for What Purposes Personal Data May Be Transferred
Your personal data may be transferred, within the limits set by the provisions of the relevant legislation and limited to achieving the purposes stated above and fulfilling the obligations imposed by the relevant legislation, to the Social Security Institution (SGK), banks, enforcement offices, the Ministry of Health of the Republic of Türkiye, lawyers, financial advisors, agencies and insurance companies for health insurance, hotels, telecom operators, building management, meal card service providers, universities and educational institutions, trainers, third-party suppliers providing goods and services including survey services, notaries, police departments, insurance companies, judicial and administrative authorities and other relevant public institutions and organizations.
V. Rights of the Data Subject Listed in Article 11 of the Law
Under the Law, you have the right to:
Learn whether your personal data are processed,
Request information if your personal data have been processed,
Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
Know the third parties to whom your personal data are transferred in Türkiye or abroad,
Request the correction of your personal data if they have been processed incompletely or inaccurately,
Request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law,
Request that the transactions carried out pursuant to subparagraphs (e) and (f) of Article 11 of the Law be notified to third parties to whom your personal data have been transferred,
Object to the occurrence of a result against you by means of the analysis of the processed data exclusively through automated systems,
Request compensation for damages if you suffer damage due to the unlawful processing of your personal data.
For detailed information on the matters explained above, you may contact KFK using the e-mail address kvkk@katilimkefalet.com.tr.
You may submit your applications regarding your rights under the Law, with a petition containing your request and documents verifying your identity, to the KFK Head Office or its Branches in person or through a notary, or to katilimfinans@hs01.kep.tr using a secure electronic signature, a mobile signature, or the e-mail address you have previously notified to KFK and that is registered in the KFK system. If a written response to your application is required and the written response exceeds 10 pages and/or must be provided on a recording medium such as a CD or flash drive, it will be subject to the fee determined by the Personal Data Protection Board in accordance with the provisions of the “Communiqué on the Procedures and Principles of Application to the Data Controller”.
Requests submitted without complying with the form and content requirements stipulated by the Law and the relevant secondary legislation may not be taken into consideration by KFK.
■ “Employees” refers to persons employed by KFK.
■ “Employee Candidates” refers to all natural persons who apply, send a CV or attend an interview with the aim of entering into an employment
relationship with KFK.