Zigana Enerji

CORPORATE

MAKYOL GROUP

Makyol blends half a century of knowledge and work experience with its strong technical competencies; creates long-term relationships and added value by producing creative solutions.

Its service philosophy, focused on customer satisfaction, differentiates Makyol from its competitors. Makyol is a first-class contracting company that is the first choice in the international arena as well as in the national market.

Makyol successfully carries out joint venture projects it has established with leading Turkish and foreign companies in the sector, both at home and abroad.

Its managerial approaches, philosophy of quality, strong values, sense of social responsibility, commitment to ethical values, the importance it attaches to the environment, occupational health and safety, and the exemplary behavior it displays in these matters draw the map of sustainable growth for Makyol.

Makyol will continue to build what is right and beautiful for humanity.

Personal Data Access, Information Security and Usage Policy

×

1. INTRODUCTION

With this Personal Data Protection and Processing Policy (“Policy”), the issues to be taken into account in the implementation by Zigana Enerji ve Yatirim Anonim Sirketi (“Zigana Energy”, “Company”) and other group companies within its organization with respect to the protection and processing of the personal data.

The policy aims at conducting the activities which have been conducted by Zigana Enerji since its incorporation in line with the care that it has taken to the protection of the personal data in compliance with the principles and rules stipulated in the Personal Data Protection Law No 6698 (“Law”), mainly the compliance to the law, honesty and transparency principles at this time.

Within the organization of Zigana Energy, all kinds of technical and administrative measures necessary for the processing and protection of the personal data are taken in line with the principles regulated in the Law and the text of this Policy. Within this scope, the necessary trainings are organized to raise the awareness of the employees.

The necessary notifications and warnings are made to the personal data owners on this matter.

2. CATEGORIZATION OF PERSONAL DATA

2.1. Personal Data

Personal data is all kinds of information regarding identified or identifiable real persons. The protection of the personal data refers only to the data belonging to real persons. The data that belongs to our company and that does not contain any information about real persons are excluded from the scope of the personal data protection. Therefore, this Policy is not applicable to the other data belonging to Zigana Energy.

2.2. Sensitive Personal Data

The sensitive personal data is the data which, if learned, may cause discrimination against or victimization of the relevant person. The data regarding the individuals’ race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, their clothing, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are sensitive personal data.

As Zigana Energy and its group companies, special importance is attached to the processing and protection of the sensitive personal data. While the sensitive personal data is being processed, first of all whether the data processing conditions exist or not is determined, and the data processing activities are carried out after ensuring the existence of conditions for the compliance to the law. The sensitive personal data is processed directly in the cases required by the legislation in accordance with the measures stipulated by the Personal Data Protection Board, and with the explicit consent of the sensitive personal data owner in other cases.

3. PRINCIPLES FOR PROCESSING OF PERSONAL DATA

Zigana Energy and its group companies process the personal data in accordance with the principles specified below and closely follow up the amendments in the legislation and other areas.

3.1. Processing in compliance with the Law and Honesty Principles

Zigana Energy processes the personal data in compliance with the law and honesty principles. Within this framework, the personal data is processed by our Company with limited information to the extent required by the business operations.

3.2. Ensuring Personal Data Is Accurate and Up-to-Date When Necessary

Zigana Energy has taken the necessary technical and administrative measures in order to ensure the accuracy and up-to-dateness of the personal data throughout the processing period. It ensures that the data is corrected upon the application of the data owner or if detected.

3.3. Processing for Specific, Explicit, and Legitimate Purposes

Zigana Energy specifically and explicitly clarifies the purposes of processing the personal data and processes it for legitimate purposes in connection with its business operations.

3.4. Personal Data Related, Limited and Restricted to the Purpose for which it is processed

Zigana Energy processes the personal data to the extent that it is necessary for the achievement of the purposes of processing data in connection with the conditions for data processing.

3.5. Retention of Personal Data for the Period stipulated by the Legal Regulations and during the Commercial Requirements

Zigana Energy complies with the period stipulated in the relevant legislation or required by the purpose of processing data. If such a period has been determined, the personal data is deleted, destroyed or anonymized in the event that the period expires or the reasons requiring the processing of the personal data disappear.

4. OUR PURPOSES FOR PROCESSING PERSONAL DATA

The personal data processing purposes of Zigana Energy and its group companies within its organization are given below as examples:

– Fulfilling the wage payment process for the employees and arranging the mandatory notifications to the Public Authorities,

- Organizing trainings for the employees,

- Developing the personal files for the employees,

- Executing the financial transactions,

- Executing the marketing activities,

- Executing the logistics activities,

- Executing the contract processes,

– Ensuring the compliance with the legislation,

- Fulfilling the financial and accounting transactions,

- Arranging the documents for performing representation activities such as power of attorney, authorization certificate for the employees,

- Establishing the necessary communication with the banks,

- Giving written replies to the notifications received from the official authorities,

- Contacting with the persons or entities with whom the company has commercial relationships,

– Ensuring the security of the workplace,

– Fulfilling the obligations to the subcontractor’s employees,

- Carrying out the transactions regarding the contracts entered into,

– Fulfilling the legal obligations,

- Following up the workplace entry times of the employees,

– Fulfilling the obligations stipulated under the Law No. 6331,

- Keeping records in terms of the legal disputes that may arise,

– Keeping the records of internet access pursuant to the Law No. 5651,

– Developing the visitor records,

- Executing the strategic planning activities,

– Ensuring the security of physical environment

5. TRANSFER OF PERSONAL DATA

Zigana Energy and the companies within the organization of the group may transfer the personal data and sensitive personal data of the personal data owners to the third parties in the country, in accordance with the law, by taking the necessary security measures in line with the purposes of processing the personal data. Accordingly, the action is taken in compliance with the personal data transfer conditions regulated in the Article 8 of the Law.

5.1. Transfer of the Personal Data in the country

Zigana Energy acts in compliance with the data processing conditions in the data transfer activities carried out in the country in accordance with the Article 8 of the Law. Accordingly, no transfer is made to third parties without the explicit consent of the data owner. However, the transfer of the personal data to third parties in the country without the explicit consent of the data owner is possible in the presence of any of the cases where the explicit consent of the data owner will not be required within the framework of the exceptions stipulated in the Law.

5.2. Transfer of the Personal Data to Abroad

Zigana Energy and the group companies within its organization can transfer the Personal Data and Sensitive Personal Data of the Personal Data Owners to third parties in abroad by taking the necessary security measures for the purposes of processing the Personal Data. The Personal Data can be transferred by our Company to the foreign countries declared to have sufficient protection by the Personal Data Protection Board or, in the absence of sufficient protection, to the foreign countries where the data controllers in Turkey and the relevant foreign country undertake sufficient protection in written and where the permit of the PDP Board has been obtained.

5.3. Third Parties to whom the Personal Data can be transferred

Zigana Energy can transfer the personal data of the data owners to the categories of persons listed below within the framework of the principles set forth in the Article 3 of this Policy in accordance with Article 8 of the Law:

– Third Party Companies in cooperation,

– Official Authorities

– Banks

– Attorneys

– Workplace Doctor

– Contracted OSGB Companies

– Company Shareholders

– Group Companies

6. EXCEPTIONAL CASES WHERE EXPLICIT CONSENT IS NOT REQUIRED IN PROCESSING OF PERSONAL DATA

Even if there is no explicit consent of the personal data owner, the personal data can be processed by taking the necessary administrative and technical measures by the company in case of the following conditions.

– The personal data processing activity is clearly stipulated in the law,

– The explicit consent of the working data owner cannot be obtained due to the actual impossibility and it is mandatory to process the personal data,

– The personal data processing activity is directly related to the establishment or performance of a contract,

– It is mandatory to perform the personal data processing activities in order for the Company to fulfill its legal obligations,

– The personal data owner anonymize his/her personal data,

– It is mandatory to process the data for the establishment or protection of a right,

– It is mandatory to process the data for the legitimate interest of our Company.

7. OBLIGATIONS FOR PROTECTION AND PROCESSING OF PERSONAL DATA

7.1. Obligation to Register with the Registry of Data Controllers (VERBIS)

Zigana Energy and other companies within its organization shall fulfill the obligation to register with the Registry of Data Controllers, which is stipulated in the Law and the Regulation on the Registry of Data Controllers, to be established by the Personal Data Protection Board if they meet the stipulated criteria, and accordingly, share the following information with the public:

– Identity and address details of the data controller and the representative of the data controller as the contact person,

– Purpose for which personal data will be processed,

– Data categories,

– Recipient or recipient groups to whom personal data will be transferred,

– Personal data intended to be transferred to the foreign countries,

– Technical and administrative measures taken with respect to the personal data security,

– Maximum period required for the purpose for which the personal data is processed.

7.2. Obligation to Inform the Personal Data Owner

Zigana Energy shall share the following information with the data owners under the Article 10 of the Law during the acquisition of the personal data.

– Identity of the Data Controller,

– Purpose for which the personal data will be processed,

– To whom and for what purpose the personal data can be transferred,

– Method and legal reasons for collecting the personal data,

– Rights of the data owner.

7.3. Obligation to Comply with the Requests of the Personal Data Owner

The personal data owners have the right to request information regarding their own data under the Article 11 of the Law by applying in written or by other methods to be determined by the Personal Data Protection Board in the cases that they consider necessary.

In this context, the personal data owners have the following rights;

- To learn whether their personal data has been processed or not,

- To request relevant information if their personal data has been processed,

- To learn the purpose of processing their personal data and whether their personal data is used as suitable for the purpose,

- To know the third persons to whom the personal data has been transferred in the country or in abroad,

- To request the correction of the personal data if the personal data has been processed deficiently or incorrectly and to request the notification of the procedure that is performed within this scope to the third persons to whom the personal data has been transferred,

- To object to the occurrence of a result against the person by analyzing the processed personal data,

- To request the elimination of the damage if they are exposed to damage due to the processing of their personal data in contrary to the Law.

7.4. Obligation to Ensure the Security of Personal Data

Zigana Energy and other companies within the organization of the group take the necessary technical and administrative measures for ensuring the appropriate level of security in order to prevent the unlawful processing of the personal data that they are processing, to prevent unlawful access to the personal data, and to ensure that the such data is stored in compliance with the law, in accordance with the Article 12 of the Law.

8. APPLICATION

In the event that the personal data owners notify their requests for their rights listed above to the address of Gayrettepe Mah. Gonenoglu Sk. No: 7 34349 Besiktas Istanbul / Turkey with wet signature or by other means specified in the legislation, their requests shall be concluded within 30 days at latest.

9. RIGHT TO COMPLAIN TO THE PERSONAL DATA PROTECTION BOARD

The personal data owner must be informed that he/she has the right to complain to the Personal Data Protection Board within 30 days if his/her application is rejected, if he/she considers the response insufficient or if the application is not responded to in time.

10. COMPLIANCE WITH THE POLICY

– The systems for deletion, destruction and anonymization of the personal data are updated.

– The necessary security systems have been established for the protection of the personal data. The system is kept up-to-date.

– The personal data owners are informed during the acquisition of the data, and the necessary information is provided if they request information.

- While establishing the policies for the protection and processing of the personal data, the actions are taken in compliance with the regulations stipulated in the Law and the relevant legislation.

11. ISSUANCE AND ENFORCEMENT OF THE POLICY

The Policy, which has been issued and entered into force by Zigana Energy, is published on the Company's website (www.ziganaenerji.com) and is made available to the relevant persons upon request. The policy is regularly audited and, if deemed necessary, updated by taking into account the developments in the legislation.