Personal Data Protection and Processing Policy

1. INTRODUCTION

1.1. Introduction

The protection of personal data is among the highest priorities of Menemen Municipality (“Municipality”). The most important aspect of this issue is the protection and processing of personal data of our employees, job candidates, interns, visitors, citizens, individuals receiving products or services, Municipality officials, supplier officials and employees, employees of institutions we cooperate with, their shareholders and officials, and third parties, as managed by this Personal Data Protection and Processing Policy (“Policy”). Everyone has the right to request the protection of their personal data according to the Constitution of the Republic of Turkey. Regarding the protection of personal data, which is a constitutional right, our Municipality pays the necessary attention to the protection of personal data of our employees, job candidates, interns, visitors, citizens, individuals receiving products or services, Municipality officials, supplier officials and employees, employees of institutions we cooperate with, their shareholders and officials, and third parties, as managed by this Policy, and makes it a Municipality policy. In this context, our Municipality takes all necessary care and administrative and technical measures to protect the personal data processed in accordance with the relevant legislation.

1.2. Scope

This Policy concerns all personal data processed automatically or non-automatically, provided that they are part of a data recording system, regarding our employees, job candidates, interns, visitors, citizens, individuals receiving products or services, Municipality officials, supplier officials and employees, employees of institutions we cooperate with, their shareholders and officials, and third parties.

1.3. Implementation of the Policy and Relevant Legislation

In terms of the processing and protection of personal data, the relevant legal regulations in force will primarily apply, and in case of any inconsistency between the legislation in force and this Policy, our Municipality accepts that the legislation in force will apply. This Policy regulates and concretizes the rules established by the relevant legislation within the scope of Municipality practices.

2. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the Personal Data Protection Law No. 6698 (“KVKK”), our Municipality takes the necessary technical and administrative measures to prevent the unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data, and conducts or commissions the necessary audits within this scope.

2.1. Ensuring the Security of Personal Data

Our Municipality takes the necessary legal, technical, and administrative measures regarding the data security of the matters specified below and pays the necessary attention and care. The actions and measures taken by our Municipality to ensure "data security" in accordance with Article 12 of KVKK are detailed below:

Our Municipality takes technical and administrative measures according to technological possibilities and implementation costs to ensure the lawful processing of personal data. Employees are informed that they cannot disclose personal data they have learned in violation of KVKK provisions and cannot use them for purposes other than processing, and they are required to make the necessary commitments in this regard, which continue even after they leave their position.
Our Municipality takes technical and administrative measures to prevent the unauthorized or negligent disclosure, transfer, or access to personal data, considering the nature of the data to be protected, technological possibilities, and implementation costs.
Our Municipality raises awareness among its data processors, such as business partners and suppliers, to prevent the unlawful processing of personal data, unlawful access to data, and ensure the lawful preservation of data.
The obligations that our Municipality, as the data controller, must comply with while processing personal data, and the legal, administrative, and technical measures developed in this regard, are contractually imposed on the institutions with which it has relationships, such as suppliers and business partners, in accordance with the nature of the data processing activity they carry out.
Our Municipality takes necessary technical and administrative measures, considering technological possibilities and implementation costs, to store personal data in secure environments and prevent their unlawful destruction, loss, or alteration.
Our Municipality conducts or commissions the necessary audits within its structure in accordance with Article 12 of KVKK. The results of these audits are reported to the relevant department within the Municipality's internal functioning, and necessary actions are taken to improve the measures taken.
In case personal data processed in accordance with Article 12 of KVKK are obtained by others through unlawful means, our Municipality operates a system to notify the relevant personal data owner and the Personal Data Protection Board ("Board") as soon as possible.

2.2. Respecting the Rights of the Data Owner, Creating Means for Data Owners to Convey Their Rights to the Municipality, and Evaluating Data Owners' Requests

In accordance with Article 13 of KVKK, our Municipality ensures the evaluation of personal data owners' requests and necessary information is provided to personal data owners by operating the necessary channels, internal functioning, administrative and technical arrangements.

Personal data owners can exercise their rights listed below in accordance with Article 11 of KVKK by submitting their requests to our Municipality in writing. Our Municipality concludes the request free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request. However, if the transaction incurs an additional cost, a fee may be charged according to the tariff determined by the Board. Personal data owners have the right to;

Learn whether their personal data is processed,
Request information if their personal data has been processed,
Learn the purpose of processing their personal data and whether they are used in accordance with their purpose,
Know the third parties to whom their personal data is transferred within the country or abroad, Request the correction of their personal data if it is incomplete or incorrectly processed and request the notification of the transaction made within this scope to the third parties to whom their personal data is transferred, Request the deletion or destruction of their personal data although it has been processed in accordance with KVKK and other relevant legal provisions, in the event that the reasons requiring processing are eliminated, and request the notification of the transaction made within this scope to the third parties to whom their personal data is transferred, Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems, Demand the compensation of the damage in case of damage due to the unlawful processing of personal data have the rights.
In accordance with the first paragraph of Article 13 of KVKK, you need to submit your request to exercise your above-mentioned rights in writing or by other methods determined by the Board. To exercise your rights, you need to submit your request to our Municipality with the necessary identification information and explanations about which of your rights specified in Article 11 of KVKK you wish to use. This will ensure that your request is answered more quickly and effectively.

2.3. Cases Outside the Rights of Personal Data Owners as Required by Legislation

In accordance with Article 28, paragraph 1 of KVKK, the following cases will be outside the scope of KVKK, and personal data owners will not be able to assert their rights:

Processing personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life, or personality rights or constitute a crime.
Processing personal data for research, planning, and statistical purposes by anonymizing them with official statistics.
Processing personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security.
Processing personal data related to investigation, prosecution, trial, or execution processes by judicial authorities or execution authorities. In accordance with Article 28, paragraph 2 of KVKK, in the following cases, except for the right to demand compensation for damage, personal data owners will not be able to assert their rights:

Processing personal data is necessary for preventing crime or for criminal investigation, Processing personal data made public by the personal data owner himself/herself, Processing personal data is necessary for the performance of supervisory or regulatory duties and disciplinary investigation or prosecution by authorized and competent public institutions and organizations and professional organizations that have the status of public institutions, based on the authority granted by law, Processing personal data is necessary for the protection of the economic and financial interests of the state with regard to budget, tax, and financial matters.

2.4. Protection of Special Categories of Personal Data

Some personal data are given special importance in KVKK due to the risk of causing victimization or discrimination when processed unlawfully. These data include race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Our Municipality takes care to protect special categories of personal data defined as "sensitive" by KVKK and processed lawfully. In this context, the technical and administrative measures taken by our Municipality for the protection of personal data are applied meticulously for special categories of personal data, and the necessary audits are ensured.

2.5. Informing and Notifying the Personal Data Owner

Our Municipality informs personal data owners in accordance with Article 10 of KVKK when obtaining personal data. In this context, our Municipality informs personal data owners during the acquisition of their personal data about the identity of our Municipality, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data, and the rights of the personal data owner under Article 11 of KVKK.

It is stipulated in Article 20 of the Constitution that everyone has the right to be informed about their personal data. Accordingly, "the right to request information" is also included among the rights of the personal data owner in Article 11 of KVKK. In this context, our Municipality provides the necessary information if the personal data owner requests it in accordance with Article 20 of the Constitution and Article 11 of KVKK.

Additionally, our Municipality informs relevant individuals about its activities, especially when seeking explicit consent, about lawful and fair personal data processing activities, and other relevant matters specified in KVKK through various public documents, primarily this Policy document. Thus, information is provided to relevant individuals within the scope of personal data processing activities, and accountability and transparency are ensured in this framework.

3. MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

In accordance with Article 20 of the Constitution and Article 4 of KVKK, our Municipality processes personal data in a lawful, fair, accurate, and necessary manner, for specific, explicit, and legitimate purposes, in a way that is relevant, limited, and proportionate to the purposes for which they are processed. Our Municipality retains personal data for the duration required by the personal data processing purpose or stipulated in the relevant legislation.

Our Municipality complies with the regulations stipulated for the processing of special categories of personal data in accordance with Article 6 of KVKK.

Our Municipality complies with the regulations stipulated in Articles 8 and 9 of KVKK regarding the transfer of personal data.

3.1. Processing of Personal Data in Accordance with the Principles Stipulated in the Legislation

3.1.1. Processing in Accordance with the Law and Fairness Principle

Our Municipality processes personal data in accordance with the principles introduced by legal regulations and the general principles of trust and fairness. In this context, personal data are processed to the extent required by our Municipality's business activities and limited to these.

3.1.2. Ensuring the Accuracy and Up-to-Dateness of Personal Data

Our Municipality takes the necessary measures to ensure that personal data is accurate and up-to-date during the processing period and establishes the necessary mechanisms to ensure the accuracy and up-to-dateness of personal data at regular intervals.

3.1.3. Processing for Specific, Explicit, and Legitimate Purposes

Our Municipality clearly defines the purposes for which personal data will be processed and processes relevant personal data within the scope of purposes related to its business activities.

3.1.4. Being Relevant, Limited, and Proportionate to the Purpose for which They are Processed

Our Municipality collects personal data only to the extent required by business activities and processes them limited to the specified purposes.

3.1.5. Retaining for the Duration Required by Relevant Legislation or the Purpose for which They are Processed

Our Municipality retains personal data for the duration required by the purpose for which they are processed and for the minimum period stipulated in the relevant legislation governing the activity. In this context, our Municipality first determines whether there is a period stipulated in the relevant legislation for retaining personal data, and if a period is stipulated, it complies with this period. If there is no legal period, personal data is retained for the duration required by the purpose for which they are processed. At the end of the retention periods, personal data are destroyed, deleted, or anonymized in accordance with periodic destruction periods or upon the request of the data subject and by the destruction methods determined (deletion and/or destruction and/or anonymization).

3.2. Conditions for Processing Personal Data

Apart from obtaining the explicit consent of the personal data owner, the basis of the personal data processing activity can be only one of the conditions listed below, or multiple conditions can be the basis of the same personal data processing activity. If the processed data is a special category of personal data, the conditions listed under the heading "Processing of Special Categories of Personal Data" in this Policy will apply.

Obtaining the Explicit Consent of the Personal Data Owner One of the conditions for processing personal data is the explicit consent of the data owner. The explicit consent of the personal data owner must be explained on a specific issue, based on information, and freely given.

In accordance with Article 5, paragraph 2 of KVKK, if one of the personal data processing conditions listed below is present, personal data may be processed without the need for the explicit consent of the data owner.

Explicitly Stipulated by Laws
If there is an explicit provision in the relevant laws regarding the processing of the personal data of the data owner, the personal data of the data owner may be processed.

Failure to Obtain the Explicit Consent of the Data Owner Due to Actual Impossibility
If it is necessary to process the personal data of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid, in order to protect the life or physical integrity of the person himself/herself or another person, the personal data of the data owner may be processed.

Direct Relevance to the Establishment or Performance of a Contract
If the processing of personal data is necessary for the establishment or performance of a contract to which the data owner is a party, this condition can be deemed fulfilled, and the personal data of the data owner may be processed.

Fulfillment of Municipality's Legal Obligation
If the processing of personal data is necessary for the Municipality to fulfill its legal obligations, the personal data of the data owner may be processed.

Personal Data Made Public by the Data Owner
If the personal data has been made public by the data owner, the relevant personal data may be processed limited to the purpose of making it public.

Necessity of Data Processing for the Establishment or Protection of a Right
If the processing of personal data is necessary for the establishment, exercise, or protection of a right, the personal data of the data owner may be processed.

Necessity of Data Processing for the Legitimate Interests of Our Municipality Provided that it does not harm the fundamental rights and freedoms of the personal data owner, if the processing of personal data is necessary for the legitimate interests of our Municipality, the personal data of the data owner may be processed.

3.3. Conditions for Processing Special Categories of Personal Data

Special categories of personal data are processed by our Municipality in accordance with the principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, under the following conditions:

Special categories of personal data other than those related to health and sexual life; if explicitly stipulated by law, in other words, if there is an explicit provision in the law to which the relevant activity is subject, can be processed without the explicit consent of the data owner. Otherwise, the explicit consent of the data owner will be obtained for the processing of such special categories of personal data.
Special categories of personal data related to health and sexual life; can be processed without the explicit consent of the data owner by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing. Otherwise, the explicit consent of the data owner will be obtained for the processing of such special categories of personal data.

3.4. Personal Data Processing Activities at Building and Facility Entrances and Within the Building and Facilities

Our Municipality carries out personal data processing activities for the purpose of ensuring security, including monitoring with security cameras at our Municipality's buildings and facilities and tracking the entrances and exits of third parties. By using security cameras and recording third party entrances and exits, our Municipality conducts personal data processing activities. In this context, our Municipality acts in accordance with the Constitution, KVKK, and other relevant legislation.

Image recordings of third parties are taken at the entrances and within the buildings and facilities of our Municipality through camera monitoring systems. Our Municipality, within the scope of camera monitoring activities, aims to improve the quality of services provided, ensure reliability, ensure the security of the Municipality and third parties, and protect the interests of third parties regarding the services they receive.

Our Municipality conducts camera monitoring activities for security purposes in compliance with the regulations stipulated in KVKK. Digital recordings and stored records are accessible only to a limited number of Municipality employees. The limited number of individuals who have access to the records declare that they will protect the confidentiality of the data they access through a confidentiality agreement. Our Municipality takes necessary technical and administrative measures to ensure the security of personal data obtained as a result of camera monitoring activities in accordance with Article 12 of KVKK.

In addition to camera recording mentioned above, our Municipality conducts personal data processing activities for the purpose of ensuring security and for the purposes specified in this Policy, by tracking the entrances and exits of third parties at our Municipality's buildings and facilities.