Ethics Whistleblowing Hotline Website Privacy Notice
ARY Holding Anonim Şirketi (JSC)
As ARY Holding Anonim Şirketi (JSC)-(Joint Stock Company) (hereinafter referred to as “ARY Holding”), within the scope of our activities arising from Law No. 6698 on the Protection of Personal Data (“KVKK”) and the relevant legislation and legal regulations, we have prepared this Personal Data Processing Privacy Notice (the “Privacy Notice”) in order to inform data subjects regarding the processing, storage and transfer of their personal data.
This Privacy Notice shall be effective as of the date it is published by ARY Holding. ARY Holding reserves the right to amend this Privacy Notice at any time, where deemed necessary.
GDPR Scope Assessment:
The data processing activities do not target individuals located in the European Union, do not involve the offering of goods or services to data subjects in the EU, and do not include the monitoring of behaviour within the EU. Therefore, pursuant to Article 3 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), these processing activities fall outside the territorial scope of the GDPR and are assessed solely within the scope of the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).
Data Subjects:
Service Recipients (Employees, Whistleblowers, Reported Persons)| Data Category | Processed Personal Data | Purposes of Processing Personal Data | Legal Grounds for Processing Personal Data | Methods of Collecting Personal Data |
|---|---|---|---|---|
| Identity Data | Name, Surname (if provided in the report) |
Conducting Audit / Ethics Activities Conducting Internal Audit / Investigation Activities Conducting Legal Affairs Carrying Out Risk Management Processes Ensuring Compliance with Legal Obligations Providing Information to Authorised Public Institutions and Organisations Monitoring and Handling Requests / Complaints |
Article 5/2(e) of Law No. 6698 – Processing is mandatory for the establishment, exercise or protection of a right Article 5/2(ç) of Law No. 6698 – Processing is mandatory for the data controller to fulfil its legal obligations Article 5/2(f) of Law No. 6698 – Processing is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed |
Collected electronically via the Ethics Whistleblowing Hotline form |
| Contact Data | Address, E-mail Address, Phone Number (if provided in the report) |
Monitoring and Handling Requests / Complaints Conducting Communication Activities Conducting Audit / Ethics Activities Conducting Legal Affairs |
Article 5/2(e) of Law No. 6698 – Processing is mandatory for the establishment, exercise or protection of a right | Collected electronically via the Ethics Whistleblowing Hotline |
| Transaction Security Data | Log Records, IP Information | Conducting Information Security Processes Ensuring the Security of Data Controller Operations Ensuring Compliance with Legal Obligations Law No. 5651 |
Article 5/2(ç) of Law No. 6698 – Processing is mandatory to fulfil a legal obligation Article 5/2(f) of Law No. 6698 – Processing is mandatory for the legitimate interests of the data controller |
Collected automatically by the system |
| Visual and Audio Records | Visual Data (photos/attachments related to the alleged violation, if provided) |
Conducting Audit / Ethics Activities Conducting Internal Audit / Investigation Activities Conducting Legal Affairs Carrying Out Risk Management Processes |
Article 5/2(e) of Law No. 6698 – Processing is mandatory for the establishment, exercise or protection of a right | Collected through upload by the whistleblower via the Ethics Whistleblowing Hotline |
To Whom and For What Purposes the Processed Personal Data May Be Transferred
Your personal data collected by ARY Holding may be transferred in accordance with Articles 8 and 9 of Law No. 6698 on the Protection of Personal Data, and solely for the purposes permitted under the applicable legislation.
| Data Category | Processed Personal Data | Purposes of Personal Data Transfer | Recipients of Personal Data | Methods of Data Transfer | Transfer of Personal Data Abroad |
|---|---|---|---|---|---|
| Identity Data | Name, Surname (if provided in the report) |
Conducting Audit / Ethics Activities Conducting Internal Audit / Investigation Activities Conducting Legal Affairs Carrying Out Risk Management Processes Ensuring Compliance with Legal Obligations Providing Information to Authorised Public Institutions and Organisations Monitoring and Handling Requests / Complaints |
Authorised public institutions and organisations; natural persons or private law legal entities (such as legal advisors, auditors, etc.) |
Electronically, through secure systems, limited to authorised persons | Not transferred abroad. |
| Contact Data | Address, E-mail Address, Phone Number (if provided in the report) |
Monitoring and Handling Requests / Complaints Conducting Communication Activities Conducting Audit / Ethics Activities Conducting Legal Affairs |
Authorised public institutions and organisations; natural persons or private law legal entities (where required for legal processes) |
Electronically, via secure communication channels | Not transferred abroad. |
| Transaction Security Data | Log Records, IP Information | Conducting Information Security Processes Ensuring the Security of Data Controller Operations Ensuring Compliance with Legal Obligations |
Authorised public institutions and organisations (upon request) |
Electronically, to authorised authorities in accordance with applicable legislation | Not transferred abroad. |
| Visual and Audio Records | Visual Data (photos/attachments related to the alleged violation, if provided) |
Conducting Audit / Ethics Activities Conducting Internal Audit / Investigation Activities Conducting Legal Affairs Carrying Out Risk Management Processes |
Authorised public institutions and organisations; natural persons or private law legal entities (limited to legal and audit processes) |
Electronically, through secure systems via the Ethics Whistleblowing Hotline | Not transferred abroad. |
What Are Your Rights as a Data Subject under Article 11 of the Law on the Protection of Personal Data?
Pursuant to Article 11 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), data subjects whose personal data are processed have the following rights;
- To learn whether their personal data are processed,
- To request information if their personal data have been processed,
- To learn the purpose of processing personal data and whether they are used in accordance with such purpose,
- To know the third parties to whom personal data are transferred, domestically or abroad,
- To object to the occurrence of a result against themselves arising from the analysis of processed data exclusively through automated systems,
- To request compensation for damages in the event that they suffer damage due to the unlawful processing of their personal data.
You may submit your requests regarding the above-mentioned rights by providing the necessary information to identify your identity and explanations regarding the right you wish to exercise under Article 11 of the KVKK, by completing the Data Subject Application Form available at www.aryholding.com, and submitting a signed copy of the form together with documents verifying your identity:
in person or via notary public to the address “Ata Sanayi No:6 Gemlik Gübre Tesisleri Kat: 2 No:/ Gemlik/Bursa (Mersis No: )”
via registered electronic mail (KEP) to aryholding@hs03.kep.tr
using a secure electronic signature or mobile signature, or via e-mail to compliance.dg@aryholding.com
ARY Holding shall finalise your request free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board under the Communiqué on the Procedures and Principles of Application to the Data Controller.
Applications must be submitted in Turkish. Applications must include the following information: name and surname, signature if the application is in writing; for Turkish citizens, the Turkish ID number; for foreigners, nationality and passport number or identification number; residential or workplace address for notification purposes; if available, the e-mail address for notification; telephone or fax number; and the subject of the request.
In applications submitted by the personal data subject to exercise the above-mentioned rights, the request must be clear and explicit, related to the applicant personally, or, if acting on behalf of another person, the applicant must be specifically authorised and must document such authorisation. The application must include identity and address information, and documents verifying identity must be attached.
This notice is hereby provided by ARY Holding in its capacity as the Data Controller within the scope of the KVKK.
Yours sincerely,
ARY Holding Anonim Şirketi (ARY Holding (JSC))
Adres: Ata Sanayi No:6 Gemlik Gübre Tesisleri Kat: 2 No:/ Gemlik/Bursa
E-Posta: compliance.dg@aryholding.com
KEP: aryholding@hs03.kep.tr
Web: www.aryholding.com
Whistleblowing Report Form
This form is created to enable employees to confidentially report ethics, compliance, corruption, bribery, sanctions violations, conflicts of interest and breaches of company policies.