Privacy Notice on the Processing of Personal Data

As SSC Sistem Teknolojileri Anonim Şirketi ("SSC" or the "Company"), we process your personal data in accordance with Personal Data Protection Law No. 6698 (the "Law") and related legislation. This notice has been prepared under Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, to explain who processes your data, for what purpose and on what legal basis, to whom it may be transferred, how it is collected, and your rights.

1. Data Controller

2. Scope of This Notice

This notice covers the personal data of the following groups of people:

• Customers and potential customers: Individuals who buy products or services from us or request a quote, and the authorized representatives, employees and contact persons of customer organizations.
• Suppliers and business partners: Individuals from whom we buy products or services or with whom we run projects, and the authorized representatives and employees of such companies.
• Visitors: People who visit our office.
• Website users: People who visit www.sscteknoloji.com and fill in the forms on the site.
• Job applicants: People who apply for a job or internship.

Our employees receive a separate privacy notice specific to the employment relationship. The cookies used on our website are explained separately in the Cookie Policy published on the site.

Data processed on behalf of our customers

While providing our customers with digital display, content management, software, installation, maintenance, remote support and system operation services, we may access or process personal data held in our customers' systems. For such data, the data controller is the relevant customer. SSC processes this data as a data processor within the meaning of the Law, within the framework of the contract with our customer and in line with their instructions. The obligation to inform regarding this data belongs to our customer, and data subject applications should also be addressed to our customer as the data controller. Applications that reach SSC directly are forwarded to the relevant customer without delay.

3. Personal Data We Process

Of the special categories of personal data listed in Article 6 of the Law, we process only the health data in documents (e.g. health reports) that our customers request from field staff under occupational health and safety rules. These documents are processed solely for the purpose of forwarding them to the relevant customer and on the basis of Article 6/3-f of the Law.

Apart from this, we do not request special categories of personal data (e.g. religion, criminal conviction information). We ask you not to share such data in CVs, forms and correspondence; if shared, this data is not taken into account in evaluations and is deleted.

4. Purposes of Processing and Legal Bases

We process your personal data for the following purposes and on the legal bases listed in Articles 5 and 6 of the Law. The abbreviations in the tables mean the following:

• Art. 5/2-a: Expressly provided for by law
• Art. 5/2-c: Processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract
• Art. 5/2-ç: Necessary for the data controller to fulfill its legal obligation
• Art. 5/2-d: Made public by the data subject
• Art. 5/2-e: Necessary for the establishment, exercise or protection of a right
• Art. 5/2-f: Necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• Art. 5/1: Explicit consent of the data subject
• Art. 6/3-f: For special categories of personal data; necessary to fulfill legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance

For individuals who are party to a contract we rely on Art. 5/2-c, and for the authorized representatives and employees of customer and supplier organizations we rely on Art. 5/2-f.

4.1 Customers and potential customers

4.2 Suppliers and business partners

4.3 Visitors

Camera and entry records kept by the building management in the common areas of the building where our office is located are not covered by this notice; the data controller for these records is the building management.

4.4 Website users

Details are provided in the Privacy & KVKK Notice and the Cookie Policy on our website.

4.5 Job applicants

The names and contact details of the references given in the CV are processed solely for the reference check and on the legal basis of Art. 5/2-f; these people are informed at the start of the conversation.

Explicit consent

For processing based on explicit consent, your consent is obtained separately from this notice. Not giving consent does not prevent you from using our products and services under the contract. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out up to that date.

5. Method of Collecting Personal Data

Your personal data is collected through face-to-face meetings, phone, email and messaging apps, the forms on our website, quote and contract documents, business cards, trade fairs and events, career platforms and CVs sent by email, installation and service forms, user accounts and system logs in SSC software; verbally, in writing or electronically; by fully or partly automated means or by non-automated means provided that it is part of a data recording system. Some data is provided to us by the organization you work for (our customer or supplier).

When you send us personal data belonging to other people (e.g. the contact details of your colleagues), we ask you to inform them and to share only the necessary data. We also ask you to notify us of changes so that your data remains accurate and up to date.

6. Transfer of Personal Data

We may transfer your personal data to the following recipient groups to the extent necessary for the purposes above:

Transfers are made in line with the conditions set out in Articles 8 and 9 of the Law and the legal bases stated in section 4, limited to the purpose.

Transfers abroad

Since we obtain email (Microsoft), website ad measurement (Google) and visit statistics (Ahrefs) services from providers based abroad, your identity, contact, transaction security and marketing data processed in these services is transferred abroad. These transfers are based on standard contracts signed with the providers and notified to the Personal Data Protection Authority (Law Art. 9/4-c). Apart from these, transfers abroad are made only under the conditions set out in Article 9 of the Law.

7. Retention Period

We keep your personal data for as long as necessary for the purpose for which it is processed and for the periods set out in the relevant legislation:

• Commercial books and documents and the records they are based on: 10 years under Article 82 of the Turkish Commercial Code
• Records subject to tax legislation: at least 5 years under Article 253 of the Tax Procedure Law (without prejudice to the 10-year period under the Turkish Commercial Code)
• Other records relating to the contractual relationship: the general limitation period from the end of the relationship (10 years under Article 146 of the Turkish Code of Obligations)
• Quote requests that did not turn into contracts, applications of candidates not hired, visitor and camera records: for the period required by the purpose of processing and the limitation periods for possible claims

When the period expires, the data is deleted, destroyed or anonymized in the first periodic disposal in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data. If a dispute or official investigation is ongoing, the relevant data may be kept until the process is concluded.

8. Your Rights

Under Article 11 of the Law, by applying to our Company you have the right to:

• learn whether your personal data is being processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your data has been transferred,
• request correction if it has been processed incompletely or inaccurately,
• request deletion or destruction within the framework of the conditions in Article 7 of the Law,
• request that correction, deletion and destruction be notified to the third parties to whom the data has been transferred,
• object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems,
• request compensation for damages if you suffer damage due to unlawful processing.

9. How to Apply

You can submit your requests in one of the following ways, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing: with a wet-signed petition, in person, through a notary public or by registered mail with return receipt, to Kazlıçeşme Mah. 245. Sk. No: 5, 34020 Zeytinburnu / Istanbul
• By email: signed with a secure electronic signature or mobile signature, or from the email address you previously notified to us and that is registered in our system, to info@sscteknoloji.com

Your application must include your name, surname and (for written applications) signature; your Turkish ID number (for foreigners, nationality and passport or ID number); your residential or business address for notifications; if any, your email address, phone or fax number for notifications; and the subject of your request. Information and documents relating to the subject are attached to the application.

We may request additional information to verify that the application belongs to you. For applications made on behalf of someone else, a power of attorney containing special authorization or a document of legal representation is required. Applications whose identity cannot be verified are rejected with the reason stated, so that data is not disclosed to unauthorized persons.

We will conclude your application as soon as possible depending on the nature of the request, and within thirty days at the latest (Law Art. 13). Applications are free of charge; however, if the written response exceeds ten pages, a fee of 1 Turkish lira may be charged for each page above ten, and if the response is provided on a recording medium such as a CD or flash drive, a fee not exceeding the cost of the medium may be charged. If the application arises from our Company's error, the fee charged is refunded.

If your application is rejected, the response is found insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days of learning of the response, and in any case within sixty days of the application date. Under Article 14 of the Law, you must first apply to our Company before filing a complaint.

The exceptions set out in Article 28 of the Law remain applicable.

10. Changes

We may update this notice in line with changes in legislation and our business processes. The current notice is published at www.sscteknoloji.com.