PRIVACY NOTICE ON PROCESSING OF EMPLOYEES PERSONAL DATA

Data Controller:

Türkiye’nin Otomobili Girişim Grubu Sanayi ve Ticaret Anonim Şirketi

Bilişim Vadisi, Muallimköy Mahallesi Deniz Caddesi No:143/1 41400 Gebze

Kocaeli-Türkiye

Introduction

As Türkiye’nin Otomobili Girişim Grubu Sanayi ve Ticaret Anonim Şirketi (“Togg”) we have prepared this Privacy Notice to inform employee candidates about processing, storage and transfer of your personal data within the scope of the Personal Data Protection Law No. 6698 (“Law”) and

the relevant legislations.

Which personal data are being processed and what are the purposes of processing your personal data?

Identity Information
Processed Personal Data	Purposes of Personal Data Processing
Name Surname Identity Number/Passport Number/Foreign Identity Number Signature Copy of Identity Card Certificate of Identity Register Copy Copy of Marriage Certificate SSI Registration Number Employee Registration Number Passport Photo ? Employee Card ID Number ? Driver's License Information ? Copy of Driver's License ? Gender ? Date of Birth ? Place of Birth ? Marital Status ? Supplier System Registration Number ? Statement of Signature ? Nationality	Execution of Emergency Management Processes, Conducting Information Security Processes, Carrying out Employee Satisfaction and Commitment Processes, Fulfillment of Labor Contact and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Conducting Audit/Ethical Activities, Conducting Training Activities, Execution of Access Authorizations, Execution of Activities in Accordance with the Legislation, Execution of Finance and Accounting, Ensuring Physical Space Security, Follow-up and Execution of Legal Affairs, Conducting Communication Activities, Conducting/Auditing Business Activities, Carrying out Occupational Health/Safety Activities, Conducting Business Continuity Activities, Procurement of Goods/Service Procurement Processes, Organization and Event Management, Implementation of Advertising/Campaign/Promotion Processes, Conducting Contract Processes, Securing Data Responsible Operations, Information to Authorized Persons, Institutions and Organizations
Legal Basis of Processing Identify Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Identify Information Collection Methods
Your identity information is collected via printed and electronic forms, electronic platforms, e-mails, contracts, in-house software and electronic programs, information and documents declared by you and telephone calls.

Contact Information
Processed Personal Data	Purpose of Personal Data Processing
? E-Mail address ? Mobile Phone Number ? Home Phone Number ? Business Phone Number ? Residence Address ? Country of Residential Address ? Certificate of Residence	Execution of Emergency Management Processes, Carrying out Employee Satisfaction and Commitment Processes, Fulfillment of Labor Contact and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Conducting Audit/Ethical Activities, Conducting Training Activities, Execution of Activities in Accordance with the Legislation, Execution of Finance and Accounting, Follow-up and Execution of Legal Affairs, Conducting Communication Activities, Conducting/Auditing Business Activities, Organization and Event Management, Conducting Contract Processes, Tracking Claims/Complaints, Information to Authorized Persons, Institutions and Organizations.
Legal Basis of Processing Personal Data
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Contact Information Collection Methods
Your contact information is collected via printed and electronic forms, electronic platforms, e-mails, contracts, in-house software and electronic programs, information and documents declared by you and telephone calls.

Personnel Information
Processed Personal Data	Purpose of Personal Date Processing
? Position/Title Information ? Task/Function Information ? Workstream Information ? Start Date of Employment ? Ending Date of Employment ? Statement of Employment ? Working Days/Hours ? CV Information ? Service/Working Certificate ? Military Status Certificate ? Copy of Pensioner Card ? SSI Service Scheme ? References ? Permitted Working Days ? Eligibility to Working Report ? AGI Information ? Overtime Working Information ? Salary Information ? Payroll Information ? Embezzlement and Personal Protective Equipment Information ? Meal Card Information	Carrying out Employee Satisfaction and Commitment Processes, Fulfillment of Labor Contact and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Conducting Audit/Ethical Activities, Conducting Training Activities, Execution of Access Authorizations, Execution of Activities in Accordance with the Legislation, Execution of Finance and Accounting, Follow-up and Execution of Legal Affairs, Conducting/Auditing Business Activities, Carrying out Occupational Health/Safety Activities, Organization and Event Management, Conducting Contract Processes, Information to Authorized Persons, Institutions and Organizations
Legal Basis of Processing Personnel Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right specified in Article 5 of the Law.
Personnel Information Collection Methods
Your personnel information is collected via printed and electronic forms, electronic platforms, e-mails, contracts, in-house software and electronic programs, information and documents declared by you and telephone calls.

Location Information
Processed Personal Data	Purpose of Personal Data Processing
? Location Information and Vehicle Tracking System Data (GPS Records) ? Route Information	Employee Benefits and Benefits Processes, Conducting Audit/Ethical Activities, Conducting/Auditing Business Activities
Legal Basis of Processing Location Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract. specified in Article 5 of the Law.
Location Information Collection Methods
Your location information is collected from third parties via email.

Legal Transaction Information
Processed Personal Data	Purpose of Personal Data Processing
? Information in Correspondence with Judicial and Administrative Authorities ? Information within the Scope of the Warning/Notification ? Information in Case Files ? Information of Salary Garnishment ? Data Protection Application Information	Fulfillment of Labor Contact and Employee Liabilities for Employees, Execution of Activities in Accordance with the Legislation, Execution of Finance and Accounting, Follow-up and Execution of Legal Affairs, Conducting/Auditing Business Activities, Conducting Contract Processes, Tracking Claims/Complaints Information to Authorized Persons, Institutions and Organizations
Legal Basis of Processing Legal Transaction Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right specified in Article 5 of the Law.
Legal Transaction Information Collection Methods
Your legal transaction information is collected via printed and electronic forms, e-mails and information and documents declared by you.

Physical Place Security Information
Processed Personal Data	Purpose of Personal Data Processing
? CCTV Recordings	Ensuring Physical Premises Security, Conducting/Auditing Business Activities, Supplying of Movable Goods’ and Resources’ Security
Legal Basis of Processing Physical Place Security Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Physical Place Security Information Collection Methods
Information on physical place security is collected via CCTV cameras.

Transaction Security Information
Processed Personal Data	Purpose of Personal Data Processing
? Username ? Password ? Access Time ? Transaction Records ? Program Membership/Group Information	Conducting Information Security Processes, Conducting Audit/Ethical Activities, Execution of Access Authorizations, Execution of Activities in Accordance with the Legislation, Conducting Communication Activities, Conducting/Auditing Business Activities, Information to Authorized Persons, Institutions and Organizations.
Legal Basis of Processing Transaction Security Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract specified in Article 5 of the Law.
Transaction Security Information Collection Methods
Your transaction security information is collected via e-mails and in-house software and electronic programs.

Finance Information
Processed Personal Data	Purpose of Personal Data Processing
? Bank Account Information ? Payment Information	Fulfillment of Labor Contracts and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Execution of Activities in Accordance with the Legislation, Execution of Finance and Accounting, Conducting/Auditing Business Activities.
Legal Basis of Processing Finance Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject specified in Article 5 of the Law..
Finance Information Collection Methods
Your finance information is collected via e-mails and information and documents declared by you.

Professional Experience Information
Processed Personal Data	Purpose of Personal Data Processing
? Educational Background ? Certificates ? Work Experiences ? Diplomas ? Education Sertificate ? Foreign Languages ? Computer Using Skills ? ISG Certificate ? Courses ? Abilities	Fulfillment of Labor Contracts and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Conducting Audit/Ethical Activities, Conducting Training Activities, Execution of Activities in Accordance with the Legislation, Conducting/Auditing Business Activities, Carrying out Occupational Health/Safety Activities, Organization and Event Management, Information to Authorized Persons, Institutions and Organizations
Legal Basis of Processing Professional Experience Information
Your professional experience information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject specified in Article 5 of the Law.
Professional Experience Information Collection Methods
Your professional experience information is collected via printed and electronic forms, electronic platforms, e-mails, in-house software and electronic programs, information and documents declared by you and telephone calls.

Visual & Audio Records Information
Processed Personal Data	Purpose of Personal Data Processing
? Photograph ? Video Records	Conducting Communication Activities, Conducting/Auditing Business Activities, Implementation of Advertising/Campaign/Promotion Processes, Organization and Event Management
Legal Basis of Processing Visual & Audio Records Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Explicit consent of the data subject specified in Article 5 of the Law.
Visual & Audio Records Information Collection Methods
Your visual & audio records information is collected through e-mails, electronic platforms, taken photos and videos by Togg or third parties.

Family Member’s Information
Processed Personal Data	Purpose of Personal Data Processing
? Spouse’s Name and Surname ? Spouse's Business Information ? Spouse's Income Status ? Spouse's Social Security Status ? Child Ownership Information ? Children's Names and Surnames ? Children's Identity Numbers ? Children's Date of Birth ? Children's Gender Information ? Children's Educational Information ? Marital Status of Children ? Children's Business Information ? Children's Blood Relationship/Adoption Information ? Child Support Payment Information ? Mother and Father’s Names and Surnames ? Names, Surnames, Phone Numbers and Relationship Degrees of Family Members	Carrying out Employee Satisfaction and Commitment Processes, Fulfillment of Labor Contracts and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Execution of Activities in accordance with the Legislation, Follow-up and Execution of Legal Affairs, Conducting/Auditing Business Activities, Organization and Event Management, Information to Authorized Persons, Institutions and Organizations
Legal Basis of Processing Family Member’s Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Family Member’s Information Collection Methods
Your family member’s information is collected via printed forms.

What is the Legal Basis of Collecting Your Special Categories of Personal Data ?

Special categories of personal data are about the person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, disguise and clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, biometric and genetic data.

Special categories of personal data require higher protection than other data categories. It is regulated in accordance with the Law that additional information should be provided in order to process such data.

Health Information
Processed Personal Data	Purpose of Personal Data Processing
? Disability Report ? Health Report ? Lung X-ray ? Blood Group Certificate ? Vaccination Card ? Hemogram Test Result ? Complete Urinalysis ? Fasting Blood Glucose ? Hemoglobin A1c o HBsAG Test Result Anti-HCV ? ALT and AST Test Result ? PFT / Breathing Test Result ? Eye Inspection Test Result ? Hearing Test Result (Audiometry) ? ECG Report ? Tetanus Vaccination Information ? Bidirectional Lumbosacral X-ray ? Two-Way Cervical X-ray	Fulfillment of Labor Contracts and Employee Liabilities for Employees, Employee Benefits and Benefits Processes, Execution of Activities in accordance with the Legislation, Conducting/Auditing Business Activities, Carrying out Occupational Health/Safety Activities, Information to Authorized Persons, Institutions and Organizations.
Legal Basis of Processing Health Information
Your health information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Personal data, except for data concerning health and sexual life, listed in the first paragraph may be processed without seeking explicit consent of the data subject, in the cases provided for by laws. Personal data concerning health and sexual life may only be processed, without seeking explicit consent of the data subject, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing specified in Article 6 of the Law. Except for the reasons listed in Article 6 of the Law, if your health data needs to be processed, your health data will be processed with your explicit consent.
Health Information Collection Methods
Your health information is collected via e-mails and documents declared by you.

Criminal Sentence And Security Measures Information
Processed Personal Data	Purpose of Personal Data Processing
? Criminal Record Document	Fulfillment of Labor Contracts and Employee Liabilities for Employees, Conducting Audit/Ethical Activities, Execution of Activities in accordance with the Legislation, Conducting/Auditing Business Activities.
Legal Basis of Processing Criminal Sentence And Security Measures Information
Your criminal sentence and security measures information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Personal data, except for data concerning health and sexual life, listed in the first paragraph may be processed without seeking explicit consent of the data subject, in the cases provided for by laws specified in Article 6 of the Law. Except for the reasons listed in Article 6 of the Law, if your criminal sentence and security measures information needs to be processed, your health data will be processed with your explicit consent.
Criminal Sentence And Security Measures Information Collection Methods
Criminal sentence and security measures information is collected via e-mails and documents declared by you.

To Whom and For What Purposes Will Your Personal Data Be Transferred?.

Your personal data will be transferred to;

? In accordance with the legal regulations and the legislation we are subject to, it is shared with the persons expressly authorized in the regulation, especially the Social Security Institution. In addition, your personal data will be shared with Authorized Persons or Public Institutions and Organizations upon the request of a court decision or authorized administrative authorities.

? Regarding the products or services to be procured from the suppliers within the scope of the service contract between us, it can be shared with our Suppliers for the purposes of conducting information security processes, carrying out employee satisfaction and commitment processes, employee benefits and benefits processes, conducting audit/ethical activities, conducting training activities, execution of access authorizations, execution of activities in accordance with the legislation, ensuring physical space security, follow-up and execution of legal Affairs, conducting communication activities, conducting/auditing business activities, carrying out occupational health/safety activities, procurement of goods/service procurement processes, organization and event management, implementation of advertising/campaign/promotion processes, conducting contract processes, tracking claims/complaints and execution of supply chain management processes.

? Your data will be shared with our Shareholders for the purpose of conducting/auditing business activities and conducting management activities.

? Within the scope of business activities to be carried out together, it can be shared with our Business Partners for the purpose of carrying out employee satisfaction and commitment processes, employee benefits and benefits processes and conducting contract processes.

Do We Export Your Personal Data Out of Country?

? Your data will be shared with our Suppliers and Subsidiary Companies for the purpose of storage and archiving activities, conducting communication activities, conducting/auditing business activities, procurement of goods/service, implementation of advertising/campaign/promotion processes and conducting contract processes. Also your data will be shared with our Business Partners for the purpose of conducting/auditing business activities and conducting contract processes.

How Long Shall Your Personal Data be Stored?

The storage period of your personal data are as follow:

? If there is a time limit for storing the data in the law or the relevant legislation, the data must

be kept for at least this period. Unless there is a time limit for storing the data in the law or the

relevant legislation, the data is stored for 10 year from the end of the employment contract.

? In the event that a possible court request or request of an administrative authority authorized by law regarding the relevant data arrives late to us or a dispute occurs to us, the period of storage of your data is determined by adding a period of 6 months to 1 year to the periods stipulated in legislation and at the end of the specified period said data are deleted or anonymized.

? If the legislation does not set a period of time for the retention of the data we process, your

data are stored as required by the relationship between us and for the period specified in the

contract with you. After this relationship is terminated or after the period specified

? If all the processing conditions for personal data have been eliminated or the storage period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you request the deletion of your data for a valid reason, your data will be deleted within 30 days at the latest. If you request the deletion or destruction of your data, the retention period of which is determined in the legislation, before the stipulated periods, your request will not be fulfilled.

What Are Your Rights on Personal Data

You have the right to request;

? to learn whether your personal data are processed or not,

? to demand for information as to if your personal data have been processed,

? to learn the purpose of the processing of your personal data and whether these personal data are used in compliance with the purpose,

? to know the third parties to whom your personal data are transferred in country or abroad,

? to request the rectification of the incomplete or inaccurate data, if any,

? to request the erasure or destruction of your data under the conditions referred to in the Law,

? to request reporting of the operations carried out to third parties to whom your personal data have been transferred, when the deletion or destruction of personal data by correcting incomplete or incorrect data is requested,

? to claim compensation for the damage arising from the unlawful processing of your personal data.

How To Exercise Your Rights As a Data Subject?

You can forward your applications and requests regarding your personal data to Togg through the Data Subject Application Form;

? By sending to kvkk@togg.com.tr address via an e-mail address,

? By applying in person to Togg with a valid identity document,

? By sending to Bilişim Vadisi, Muallimköy Mahallesi Deniz Caddesi No:143/1 41400 Gebze/Kocaeli address together with wet-signed application and ID photocopy,

? By sending via e-mail with mobile signature or secure electronic signature to kvkk@togg.com.tr,

? By sending via a registered electronic mail (REM) address and secure electronic signature or mobile signature to our registered electronic mail address turkiyeninotomobili@hs01.kep.tr

In accordance to Communique On The Principles And Procedures For The Request To Data Controller, data subjects request must include name, surname, signature (if the request is made in writing), T.C. identity number (for foreigners, nationality, passport number or identity number if available), residential and business address subject to the notification, electronic mail address, telephone, fax number subject to notification if available and subject of demand.

Data subject should clearly and comprehensively state the subject requested in the application, which include explanations he/she will make regarding the request to use the rights mentioned above. Information and documents related to the application should be added to the application.

Although the subject of the request must be related to the person who makes the application, if acting on behalf of someone else, the applicant must be specifically authorized in this regard and this authorization must be documented (power of attorney). In addition, the application must contain identity and address information, and a document confirming identity must be added to the application.

Requests made by unauthorized third parties on behalf of someone else will not be considered.;

How Long Will Your Requests Regarding the Processing of Your Personal Data Be Answered?

Your requests regarding your personal data are evaluated and answered as soon as possible and within 30 days at the latest from the date they reach Togg. If your request is accepted or rejected by explaining the reason, our reply will be sent to the address you specified in the application, primarily by postal or e-mail, if possible, in the same manner as your request.

User Login