Personal Data Protection Policy

GÜNBAY KURAL ABBASOĞLU LAW FIRM
PERSONAL DATA PROCESSING AND PROTECTION POLICY

1. THE OBJECTIVE OF THE PERSONAL DATA PROTECTION POLICY

The objective of the Personal Data Protection Policy is to provide information regarding the systems adopted for personal data processing, and the protection of personal data that are conducted by Günbay Kural Abbasoğlu law Firm (“GKA”), in accordance with the Personal Data Protection Law (“PDPL”) numbered 6698 and related legislation. In this respect, this policy aims to enlighten the persons whose personal data has been processed and, in particular, our employees, prospective employees, clients, their employees and signatory persons, suppliers and visitors, as well as the employees, shareholders and officials of the institutions that we are in collaboration with, and third parties.

2. THE SCOPE OF THE POLICY

This policy includes explanations regarding the content, categories, means of use, and the processing means of personal data, its maintenance conditions, the rights of data subjects, and precautions taken to protect personal data.

3. THE PURPOSE OF PROCESSING OF THE PERSONAL DATA

GKA undertakes that it shall process all personal data pursuant to the principles that are determined within the scope of Article 4 of the PDPL, and in accordance with the purposes stated, below:

• a. Implementing every type of advocacy and legal consultancy activities
• b. Implementing or ensuring additional/complementary services (external and internal auditing, accounting, tax counseling, IT, translation etc.) for the performance of the above-mentioned activities
• c. Providing information and documentation requested under the relevant legislation by judicial or administrative authorities, including execution offices, law enforcement officers
• d. Communication with our clients, their stakeholders, and third-party communication on behalf of our clients, within the context of the services provided to our clients
• e. Carrying out corporate communication processes and improving client relations and communication
• f. Carrying out invoicing, payment, accounting, and settlement processes
• g. Informing clients of legislative and other developments
• h. Carrying out internal processes such as finance, IT, HR, office administration, secretariat, correspondences, archive, etc.
• i. Supplying information with regard to various legal developments and providing scientific articles
• j. Providing legal trainings organized by GKA, related documents and informing on future trainings that wil be made by GKA
• k. Conservation of the data that is obtained in this respect, in order to be able to preserve them for future processing
• l. Exercising the rights vested in the laws and regulations, such as the labor law, social security law, and tax law, etc., and fulfilling the obligations arising from the latter of these
• m. Adding Personal Data into our website for informational purposes
• n. Resolution of disputes arising from the labor law
• p. Corporate planning
• r. Ensuring the order, control, security, administration, and harmonization in the workplace,
• s. Implementing our recruitment process.

4. DATA COLLECTION METHOD

GKA may collect Personal Data through the medium of verbal communication, e-mails, telephone, post, couriers, deliveries by hand, communication through its web site, etc.

5. AUTHORIZATION OF PROCESSING AND TRANSFER

The domestic processing of Personal Data and their transfer to third natural or legal parties may be affected by the express consent of the data subject. Pursuant to Article numbered 5 of the PDPL, in the absence of express consent, personal data may be processed in the following circumstances:

• a. Explicit provision of law
• b. In the event it is required for the security of the life or physical integrity of the data subject who cannot express its consent because of physical incapacity, or whose consent is not legitimized, either for the security of life or physical integrity of another person
• c. In the event the processing of personal data of parties to a contract is required, provided that it is directly related to the execution or performance of this contract
• d. In the event it is required for the performance of the legal obligations of GKA
• e. In the event it is already disclosed by the Data Subject
• f. In the event the processing of data is required for the establishment of a right, its exercise, or its protection
• g. In the event the processing of data is required for the legitimate interests of GKA, provided that the fundamental rights and freedoms of the related person are protected.

Personal Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, memberships of association, foundations or trade-unions, health, sexual orientation, criminal conviction and security measures, and biometrics and genetics are special categories of Personal Data. The Processing and Transfer of special categories of personal data may be affected with the express consent of the related person. In the absence of express consent:

• a. Personal Data that is not related to health condition or sexual orientation may be processed without obtaining the express consent of the related person if it is regulated by law
• b. Personal Data that is related to health condition or sexual orientation may be processed without obtaining the express consent of the related person by real persons or competent institutions and organizations that are under a confidentiality obligation, purely and simply for the express purpose of the protection of public health, preventive medicine, medical diagnosis, the course of treatment and maintenance services, and the planning and management of health services

The processing of Personal Data abroad and their transfer to third natural or legal parties may be affected by the express consent of the data subject. In the absence of express consent, Personal Data may be processed in the presence of one of the conditions stipulated under Articles numbered 5/2 and 5/3 of the PDPL, and in the presence of the below-stated conditions:

• a. Adequate protection is provided, as it is determined and announced by the Personal Data Protection Board (“Board”)
• b. Data Controllers in Turkey and in the concerned foreign country undertake, in writing, to provide adequate protection, as well as the authorization of the Board, if sufficient protection does not exist in the foreign country

Furthermore, provided that international agreement clauses are reserved, in the event serious harm is made to the interest of the country or to the related person, Personal Data may be transferred abroad, provided that the opinion of the related state institution or organization is obtained, and the Board authorizes the transfer

6. NEWSLETTER SUBSCRIPTIONS

If you have requested to be included in the delivery list for our Newsletters, your personal data may be processed for the purposes of performing the relevant delivery. If you no longer wish to receive e-mails from GKA regarding the deliveries in question, you may click on the link indicating “Please click if you do not want to receive information e-mail” included in the e-mail that has been sent to you or please reply to e-mail by stating that you do not wish to receive bulletins.

7. PROTECTION OF RIGHTS OF THE DATA SUBJECT

Data Subjects may make use of their below-stated rights by application to GKA:

• a. Ascertaining whether any personal data is processed or not
• b. Requesting information related to the processing of personal data, if processed
• c. Ascertaining the purpose of the processing of personal data, and whether or not the use of Personal Data is in compliance with this purpose
• d. Identifying third parties to whom the personal data is transferred within the country and abroad
• e. Requesting rectification if personal data is processed in an unsatisfactory or incorrect manner
• f. Demanding deletion or destruction of personal data within the framework of Article 7 of the PDPL
• g. Demanding the notification of adjustment, deletion and destruction to third parties to whom the personal data had been transferred
• h. Objection to the result of the analyzation (exclusively by means of automatic systems) of the processed personal data, and which is to the detriment of the person and
• i. Claiming compensation for damages that he/she suffered due to the illegal processing of the personal data

For the exercise of these rights as stated, above, it is required for Data Subjects to send their requests in written or through registered electronic mail address, which is notified before to GKA by the Data subject and registered in GKA’s system; or the requests may be also delivered through a software or application developed for the objective of application to the electronic address of GKA, i.e. info@gkalaw.com or to it residing address at Esentepe Mah. Kore Şehitleri Cad. No:33/1 Esentepe - Şişli, İstanbul/ Turkey.

It is obligatory for the Data Subjects’s application to include, name, surname, signature (if the application is written), identity number for Turkish Republic Citizens, nationality, passport number and identity number (if applicable) for the foreigners, place of residence or work to be used in the notifications, electronic mail address to be declared (if applicable), telephone and fax numbers and the subject of request.

8. PRECAUTIONS RELATED TO ACCURATE AND UPDATED CONSERVATION, SECURITY AND PROTECTION OF PERSONAL DATA

GKA shall take all necessary technical and administrative precautions to ensure the accurate and updated conservation of Personal Data, to conserve Personal Data in secure media, and to avoid the disappearance, transformation and illegal use of Personal Data.

In the event that personal data is processed by a natural or legal persons on behalf of GKA, and in the matter of the precautions stated in this paragraph, GKA is jointly and severally liable together with the other data processors.

GKA and its employees can neither disclose personal data to third parties in violation of the PDPL, nor may it make use of this knowledge beyond the level of processing. This obligation also continues after their resignation.

If personal data by third parties is obtained in an illegal manner, GKA shall report this fact to the data owner concerned, and to the Data Protection Board within 72 hours in order to be able to take the necessary precautions.

• • Activities related to Personal Data processing are defined in the Quality Management System. The requirements for legal conformity, based on these activities, are developed by way of application rules and auditing methods.
• • Briefings and Trainings are regularly organized for the purpose of increasing the awareness of GKA employees regarding the relevant legislation on the protection of Personal Data.
• • Personal data is kept separately, the retention period of this data is systematically tracked, and their destruction process is audited.
• • Regular system reports are obtained for network security. Technological developments are followed, and the information systems are renewed and updated.
• • Internet security is ensured by firewall and by internet infrastructure. The interlocation secure network connection and the antivirus programs that are designated according to needs and necessities, are used.

9. AMENDMENTS TO PERSONAL DATA PROTECTION POLICY

GKA may make amendments from time to time to this Policy that are required due to their activities, or that which are legally necessary. These amendments enter into force by the publication of the amended Policy on the website.