PRIVACY NOTICE ON PROCESSING OF EMPLOYEES PERSONAL DATA

Data Controller	Türkiye’nin Otomobili Girişim Grubu Sanayi ve Ticaret Anonim Şirketi (‘‘Togg’’)
Address	Muallimköy Mah. Deniz Cad. Bilişim Vadisi T.G.B. Sitesi 1.3.A Blok No:143/9 İç Kapı No:105 Gebze/Kocaeli-Türkiye

Introduction

As Türkiye’nin Otomobili Girişim Grubu Sanayi ve Ticaret Anonim Şirketi (“Togg”), we have prepared this Privacy Notice to inform employees about processing, storage and transfer of your personal data within the scope of the Personal Data Protection Law No. 6698 (“Law”) and the relevant legislations.

Which Personal Data Are Processed and What Are the Purposes of Processing Your Personal Data?

Identity Information
Processed Personal Data	Purpose of Personal Data Processing
? Name ? Surname ? Turkish ID Number / Passport Number / Foreign ID Number ? Signature ? Copy of Identity Card ? Complete Extract of the Civil Registry ? Copy of Marriage Certificate ? Social Security (SGK) Registration Number ? Personnel Registration Number ? Passport Photo ? Driver’s License Information ? Gender ? Date of Birth ? Place of Birth ? Marital Status ? Signature Declaration ? Nationality	Conducting Emergency Processes, Conducting Information Security Processes, Conducting Employee Satisfaction and Loyalty Processes, Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes,Conducting Inspection/Audit & Ethical Activity Processes,Conducting Education Activity Processes, Conducting Access Authorization Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Finance and Accounting Processes, Maintaining Physical Location Security, Monitoring & Processing of Legal Affairs, Conducting Communication Activities, Conducting & Inspection of Business Activities, Conducting Occupational Health / Safety Activities, Conducting Activities Concerning the Continuity of the Business , Conducting Goods / Services Procurement Processes, Organization and Event Management, Conducting Advertisement / Campaign / Promotion Processes, Conducting Contractual Processes, Ensuring the Security of Data Controller Operations, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Identity Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject, specified in Article 5 of the Law.
Identity Information Collection Methods
Your identity information is collected via printed and electronic forms, electronic platforms, e-mails, contracts, in-house software and electronic programs, information and documents declared by you and telephone calls.

Contact Information
Processed Personal Data	Purpose of Personal Data Processing
? E-mail Address ? Mobile Phone Number ? Home Phone Number ? Business Phone Number ? Address Information	Conducting Emergency Processes, Conducting Employee Satisfaction and Loyalty Processes, Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting Inspection/Audit & Ethical Activity Processes,Conducting Education Activity Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Finance and Accounting Processes, Monitoring & Processing of Legal Affairs, Conducting Communication Activities, Conducting & Inspection of Business Activities, Organization and Event Management, Conducting Contractual Processes, Ensuring the Security of Data Controller Operations, Keeping Track of Requests / Complaints, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Personal Data
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Contact Information Collection Methods
Your contact information is collected via printed and electronic forms, electronic platforms, e-mails, in-house software and electronic programs, information and documents declared by you and telephone calls.

Personnel Information
Processed Personal Data	Purpose of Personal Data Processing
? Position / Title Information ? Task/Function Information ? Workstream Information ? Start Date of Employment ? Ending Date of Employment ? Statement of Employment ? Working Days / Hours Information ? CV Information ? Service/Working Certificate ? Military Status Certificate ? Copy of Pensioner Card ? Social Security (SGK) Service Record ? References ? Permitted Working Days ? Eligibility to Working Report ? AGI Information ? Overtime Working Information ? Salary Information ? Payroll Information ? Embezzlement and Personal Protective Equipment Information ? Meal Card Information	Conducting Employee Satisfaction and Loyalty Processes, Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting Inspection/Audit & Ethical Activity Processes, Conducting Education Activity Processes, Conducting Access Authorization Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Finance and Accounting Processes, Monitoring & Processing of Legal Affairs, Conducting & Inspection of Business Activities, Conducting Occupational Health / Safety Activities, Organization and Event Management, Conducting Contractual Processes, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Personnel Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right specified in Article 5 of the Law.
Personnel Information Collection Methods
Your personnel information is collected via printed and electronic forms, electronic platforms, e-mails, contracts, in-house software and electronic programs, information and documents declared by you and telephone calls.

Location Information
Processed Personal Data	Purpose of Personal Data Processing
? Location Information and Vehicle Tracking System Data (GPS Records) ? Route Information	Conducting Fringe Benefits and Benefit Processes, Conducting Inspection/Audit & Ethical Activity Processes, Conducting & Inspection of Business Activities
Legal Basis of Processing Location Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract specified in Article 5 of the Law.
Location Information Collection Methods
Your location information is collected from third parties via email.

Legal Transaction Information
Processed Personal Data	Purpose of Personal Data Processing
? Information in Correspondence with Judicial and Administrative Authorities ? Information within the Scope of the Warning/Notification ? Information in Case Files ? Information of Salary Garnishment ? Data Protection Application Information	Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Finance and Accounting Processes, Monitoring & Processing of Legal Affairs, Conducting & Inspection of Business Activities, Conducting Contractual Processes, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Legal Transaction Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Data processing is necessary for the establishment, exercise or protection of any right, ? It is necessary for compliance with a legal obligation to which the data controller is subject, specified in Article 5 of the Law.
Legal Transaction Information Collection Methods
Your legal transaction information is collected via printed and electronic forms, e-mails and information and documents declared by you.

Physical Place Security Information
Processed Personal Data	Purpose of Personal Data Processing
? CCTV Recordings	Maintaining Physical Location Security, Conducting & Inspection of Business Activities, Providing Security for Movable Estate / Resources
Legal Basis of Processing Physical Place Security Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Physical Place Security Information Collection Methods
Information on physical place security is collected via CCTV cameras.

Transaction Security Information
Processed Personal Data	Purpose of Personal Data Processing
? Username ? Password ? Access Time ? Transaction Records	Conducting Information Security Processes, Conducting Inspection/Audit & Ethical Activity Processes, Conducting Access Authorization Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Communication Activities, Conducting & Inspection of Business Activities, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Transaction Security Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract specified in Article 5 of the Law.
Transaction Security Information Collection Methods
Your transaction security information is collected via e-mails, in-house software and electronic programs.

Finance Information
Processed Personal Data	Purpose of Personal Data Processing
? Bank Account Information ? Payment Information	Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Finance and Accounting Processes, Conducting & Inspection of Business Activities
Legal Basis of Processing Finance Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject specified in Article 5 of the Law.
Finance Information Collection Methods
Your finance information is collected via e-mails and information and documents declared by you.

Professional Experience Information
Processed Personal Data	Purpose of Personal Data Processing
? Educational Background ? Certificates ? Work Experiences ? Diplomas ? Education Certificate ? Foreign Languages ? Computer Using Skills ? ISG Certificate ? Courses ? Abilities	Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting Inspection/Audit & Ethical Activity Processes, Conducting Education Activity Processes, Conducting Activities In Accordance With the Required Legislation, Conducting Communication Activities, Conducting & Inspection of Business Activities, Conducting Occupational Health / Safety Activities, Organization and Event Management, Conducting Contractual Processes, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Professional Experience Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ? It is necessary for compliance with a legal obligation to which the data controller is subject specified in Article 5 of the Law.
Professional Experience Information Collection Methods
Your professional experience information is collected via printed and electronic forms, electronic platforms, e-mails, in-house software and electronic programs, information and documents declared by you and telephone calls.

Visual & Audio Records Information
Processed Personal Data	Purpose of Personal Data Processing
? Photograph ? Video Recordings	Conducting Communication Activities, Conducting & Inspection of Business Activities, Conducting Advertisement / Campaign / Promotion Processes, Organization and Event Management
Legal Basis of Processing Visual & Audio Records Information
Your personal data is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? Explicit consent of the data subject specified in Article 5 of the Law.
Visual & Audio Records Information Collection Methods
Your visual & audio records information is collected through e-mails, electronic platforms, taken photos and videos by Togg or third parties.

Family Member’s Information
Processed Personal Data	Purpose of Personal Data Processing
? Spouse’s Name and Surname ? Spouse’s Employment Information ? Spouse’s Income Status ? Spouse’s Social Security Status ? Information on Having Children ? Children’s Names and Surnames ? Children’s Turkish ID Numbers ? Children’s Dates of Birth ? Children’s Gender ? Children’s Education Information ? Marital Status of Children ? Children's Business Information ? Information on Blood Relation / Adoption of Children ? Child Support Payment Information ? Mother and Father’s Names and Surnames ? Names, Surnames, Phone Numbers and Relationship Degrees of Family Members	Conducting Employee Satisfaction and Loyalty Processes, Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting Activities In Accordance With the Required Legislation, Monitoring & Processing of Legal Affairs, Conducting Communication Activities, Conducting & Inspection of Business Activities, Organization and Event Management, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Family Member’s Information
Your family member’s information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is expressly provided for by the laws, ? It is necessary for compliance with a legal obligation to which the data controller is subject, ? Data processing is necessary for the establishment, exercise or protection of any right, ? Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject specified in Article 5 of the Law.
Family Member’s Information Collection Methods
Your family member’s information is collected via printed forms.

What is the Legal Basis of Collecting Your Special Categories of Personal Data ?

Special categories of personal data are about the person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, disguise and clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, biometric and genetic data.

Special categories of personal data require higher protection than other data categories. It is regulated in accordance with the Law that additional information should be provided in order to process such data.

Health Information
Processed Personal Data	Purpose of Personal Data Processing
? Disability Report ? Health Report ? Lung X-ray ? Blood Group Certificate ? Vaccination Card ? Hemogram Test Result ? Complete Urinalysis ? Fasting Blood Glucose ? Hemoglobin A1c o HBsAG Test Result Anti-HCV ? ALT and AST Test Result ? PFT / Breathing Test Result ? Eye Inspection Test Result ? Hearing Test Result (Audiometry) ? ECG Report ? Tetanus Vaccination Information ? Bidirectional Lumbosacral X-ray ? Two-Way Cervical X-ray	Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Fringe Benefits and Benefit Processes, Conducting & Inspection of Business Activities, Conducting Occupational Health / Safety Activities, Informing Authorised Bodies and Authorised Persons
Legal Basis of Processing Health Information
Your health information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, ? It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and for the planning, management and financing of health-care services by persons subject to legal obligation of confidentiality or by competent public institutions and organizations specified in Article 6 of the Law.
Health Information Collection Methods
Your health information is collected via e-mails and information and documents declared by you.

Criminal Sentence and Security Measures
Processed Personal Data	Purpose of Personal Data Processing
? Criminal Record Document	Conducting Labor Contract Obligations and Legislative Obligations Processes, Conducting Inspection/Audit & Ethical Activity Processes, Conducting Activities In Accordance With the Required Legislation, Conducting & Inspection of Business Activities
Legal Basis of Processing Criminal Sentence And Security Measures Information
Your criminal sentence and security measures information is processed by Togg in line with the fulfillment of the purposes listed above, based on the legal basis of ? It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, specified in Article 6 of the Law.
Criminal Sentence And Security Measures Information Collection Methods
Criminal sentence and security measures information is collected via e-mails and information and documents declared by you.

To Whom and For What Purposes Will Your Personal Data Be Transferred?

Your personal data will be transferred to;

? In accordance with the legal regulations and the legislation we are subject to, it is shared with the persons expressly authorized in the regulation, especially the Social Security Institution. In addition, your personal data will be shared with Authorized Persons or Public Institutions and Organizations upon the request of a court decision or authorized administrative authorities.

? Regarding the products or services to be procured from the suppliers within the scope of the service contract between us, it can be shared with our Suppliers for the purposes of conducting information security processes, conducting employee satisfaction and loyalty processes, conducting fringe benefits and benefit processes,conducting inspection/audit & ethical activity processes,conducting education activity processes, conducting access authorization processes, conducting activities in accordance with the required legislation, maintaining physical location security, monitoring & processing of legal affairs, conducting communication activities, conducting & inspection of business activities, conducting occupational health / safety activities, conducting goods / services procurement processes, organization and event management, conducting advertisement / campaign / promotion processes, conducting contractual processes, keeping track of requests / complaints, keeping track of requests / complaints.

? Your data will be shared with our Shareholders for the purpose of conducting/auditing business activities and conducting management activities.

? Within the scope of business activities to be carried out together, it can be shared with our Business Partners for the purpose of carrying out employee satisfaction and commitment processes, employee benefits and benefits processes and conducting contract processes.

Do We Export Your Personal Data Out of Country?

? Your data will be shared with our Suppliers and Subsidiary Companies for the purpose of storage and archiving activities, conducting communication activities, conducting/auditing business activities, procurement of goods/service, carrying out advertising/campaign/promotion processes and conducting contract processes in accordance with Article 9 of the Personal Data Protection Law and by taking the necessary technical and administrative measures based on the legal ground of “signing a standard contract”.

? Your data will be shared with our Business Partners for the purpose of conducting/auditing business activities and conducting contract processes in accordance with Article 9 of the Personal Data Protection Law and by taking the necessary technical and administrative measures based on the legal ground of “signing a standard contract”.

How Long Shall Your Personal Data be Stored?

The storage period of your personal data are as follow:

? If there is a time limit for storing the data in the law or the relevant legislation, the data must be kept for at least this period. Unless there is a time limit for storing the data in the law or the relevant legislation, the data is stored for 10 years from the end of the employment contract.

? In the event that a possible court request or request of an administrative authority authorized by law regarding the relevant data arrives late to us or a dispute occurs to us, the period of storage of your data is determined by adding a period of 6 months to 1 year to the periods stipulated in legislation and at the end of the specified period said data are deleted or anonymized.

? If the legislation does not set a period of time for the retention of the data we process, your data are stored as required by the relationship between us and for the period specified in the contract with you. After the termination of the aforementioned relationship or after the period specified in the contract has passed, your data will be deleted, destroyed, or anonymized without any request from you.

? If all the processing conditions for personal data have been eliminated or the storage period declared by us or determined within the scope of the legislation has expired, your data will be deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you request the deletion of your data for a valid reason, your data will be deleted within 30 days at the latest. If you request the deletion or destruction of your data, the retention period of which is determined in the legislation, before the stipulated periods, your request will not be fulfilled.

What Are Your Rights on Personal Data

You have the right to request;

? to learn whether your personal data are processed or not,

? to demand for information as to if your personal data have been processed,

? to learn the purpose of the processing of your personal data and whether these personal data are used in compliance with the purpose,

? to know the third parties to whom your personal data are transferred in country or abroad,

? to request the rectification of the incomplete or inaccurate data, if any,

? to request the erasure or destruction of your data under the conditions referred to in the Law,

? to request reporting of the operations carried out to third parties to whom your personal data have been transferred, when the deletion or destruction of personal data by correcting incomplete or incorrect data is requested,

? to claim compensation for the damage arising from the unlawful processing of your personal data.

How To Exercise Your Rights As a Data Subject?

You can forward your applications and requests regarding your personal data to Togg through the Data Subject Application Form;

? By sending to togg.kvkk@togg.com.tr address via an e-mail address,

? By applying in person to Togg with a valid identity document,

? By sending to Muallimköy Mah. Deniz Cad. Bilişim Vadisi T.G.B. Sitesi 1.3.A Blok No:143/9 İç Kapı No:105 Gebze/Kocaeli-Türkiye address together with wet-signed application and ID photocopy,

? By sending via e-mail with mobile signature or secure electronic signature to togg.kvkk@togg.com.tr,

? By sending via a registered electronic mail (REM) address and secure electronic signature or mobile signature to our registered electronic mail address turkiyeninotomobili@hs01.kep.tr.

In accordance with Communique On The Principles And Procedures For The Request To Data Controller, data subject requests must include name, surname, signature (if the request is made in writing), T.C. identity number (for foreigners, nationality, passport number or identity number if available), residential and business address subject to the notification, electronic mail address, telephone, fax number subject to notification if available and subject of demand.

The data subject should clearly and comprehensively state the subject requested in the application, which include explanations he/she will make regarding the request to use the rights mentioned above. Information and documents related to the application should be added to the application.

Although the subject of the request must be related to the person who makes the application, if acting on behalf of someone else, the applicant must be specifically authorized in this regard and this authorization must be documented (power of attorney). In addition, the application must contain identity and address information, and a document confirming identity must be added to the application.

Requests made by unauthorized third parties on behalf of someone else will not be considered.

How Long Will Your Requests Regarding the Processing of Your Personal Data Be Answered?

Your requests regarding your personal data are evaluated and answered as soon as possible and within 30 days at the latest from the date they reach Togg. If your request is accepted or rejected by explaining the reason, our reply will be sent to the address you specified in the application, primarily by postal or e-mail, if possible, in the same manner as your request.

User Login