PRIVACY STATEMENT ON THE PROCESSING OF PERSONAL DATA
“Ethics Hotline”
1. Data Controller
As Borusan Holding A.Ş. (“Borusan Holding” or the “Company” ) we value the importance on the protection of your personal data. In accordance with Personal Data Protection Law No.6698 (the “Law”), we act as the data controller in the processing of your personal data submitted through the Ethics Reporting Line form for the purpose of making a complaint and/or notification.
With this Privacy Statement, we aim to inform you about how we process your personal data within the scope of the Ethics Reporting Line procedures.
2. Processed Personal Data, Purposes of Processing and Legal Grounds
Article 5 of the Law regulates the legal grounds for processing personal data. Below, we outline the purposes for which we process personal data and the corresponding legal grounds on which we rely within the scope of such purposes:
| Purposes of Processing Your Data |
Legal Grounds for Processing |
Processed Personal Data |
- Receiving your complaints and/or notifications through the Ethics Reporting Line,
- Recording, tracking, and resolving your complaints and/or notifications,
- Requesting additional information and documents when necessary,
- Preventing the conduct of activities in violation of contracts and/or legislation, and carrying out internal audit, investigation, intelligence, control, reporting, testing, and development activities within this scope,
- Reviewing your complaints and/or notifications and reporting the results thereof in order to ensure compliance with the Company’s ethical rules and national regulations,
- Identifying potential irregularities or abuses that may arise in the Company’s business and operational processes,
- Ensuring the security of Company employees and relevant third parties.
|
Law Art. 5/2(f)
Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
|
- Personnel: (Department, unit information)
- Transaction Security: (User log records, IP address information, website login–logout information, device ID information)
- Other: (Name of the company to which the notification is intended to be made, type of relationship with the company, details and responses provided regarding the subject of the notification)
If you choose to share:
- Identity (Name, Surname)
- Contact (Phone Number, E-mail Address)
|
-
Fulfilling our legal obligations in cases where authorized institutions or organizations request information from the Company or when we are required to notify such institutions (including disclosure of your information in case of the need to provide information to authorized institutions and organizations)
|
Law Art. 5/2(ç)
It is necessary for compliance with a legal obligation to which the data controller is subject.
|
- Personnel: (Department, unit information)
- Transaction Security: (User log records, IP address information, website login–logout information, device ID information)
- Other: (Name of the company to which the notification is intended to be made, type of relationship with the company, details and responses provided regarding the subject of the notification)
- Legal Transaction: (Information included in a lawsuit/enforcement file in case of a possible dispute, correspondence made with competent authorities and institutions)
If you choose to share:
- Identity (Name, Surname)
- Contact (Phone Number, E-mail Address)
|
-
Protecting and exercising our rights in case of a possible dispute as well as conducting legal proceedings.
|
Law Art. 5/2(e)
Data processing is necessary for the establishment, exercise or protection of any right.
|
3. Third Parties with Whom Your Personal Data is Shared and Purposes of Sharing
Your personal data is shared with third parties in compliance with the rules regarding the transfer of personal data set forth in the Law and relevant regulations. The parties with whom data is shared and the purposes of such sharing are specified below:
-
Authorized Institutions and Organizations - In cases where an authorized institution or organization requests information from our Company or where notification to such institutions is required, personal data is shared to fulfill legal obligations.
-
Suppliers and Business Partners - Receiving support from suppliers that provide information technology infrastructures, products, and services, and receiving services from a supplier within the scope of collecting notifications through the Ethics Reporting Line.
Your personal data are transferred abroad in accordance with the Law and the Regulation on Procedures and Principles Regarding the Transfer of Personal Data Abroad (“Regulation”), which entered into force upon its publication in the Official Gazette dated 10 July 2024 and numbered 32598.
During the transfer of personal data abroad, Borusan Holding and the data recipient act in compliance with the requirements set forth under Article 9 of the Law and the Regulation, and appropriate safeguards are provided for the transfer of personal data abroad, including enabling the data subject to exercise their rights and to have access to effective legal remedies in the recipient country, in accordance with Article 9(4) of the Law.
4. Methods of Collecting Your Personal Data
The personal data specified above are collected through the completion of the Ethics Reporting Line form by using automated or partially automated methods.
5. Rights of the Data Subject
Article 11 of the Law regulates the rights of data subjects. As a data subject, you may exercise your rights specified under Article 11 of the Law by choosing one of the following methods: