This is an English translation of our Personal Data Protection and Processing Policy, provided for information purposes. In the event of any discrepancy, the Turkish version shall prevail.
Within the scope of the business activities carried out by İletim Mühendislik San. ve Tic. Ltd. Şti. (“İletim Mühendislik” or the “Company”), the protection of personal data is one of our Company’s priorities. This Personal Data Protection and Processing Policy (the “Policy”), adopted by İletim Mühendislik, sets out the basic principles adopted to ensure that İletim Mühendislik’s data processing activities comply with the Turkish Personal Data Protection Law No. 6698 (the “Law”), and provides information on all personal data processing activities carried out by our Company.
This Policy applies to all data subjects other than İletim Mühendislik employees. İletim Mühendislik employees are subject to the separate İletim Mühendislik Employee Personal Data Protection and Processing Policy, which has been prepared in line with the principles of this general Policy.
In general, the legal regulations in force on the processing and protection of personal data shall apply first. In the event of a conflict between the Law in force and this Policy, our Company accepts that the Law in force shall apply. This Policy sets out the rules laid down by the relevant legislation as they are applied in the Company’s practices.
Our Company takes the necessary measures, in accordance with the nature of the personal data, to prevent unlawful processing of, access to or transfer of personal data and any other security deficiencies, and to ensure that personal data is safeguarded. In this context, in line with the guidelines of the Personal Data Protection Board (the “Board”), it takes technical and administrative measures to ensure the required level of security and carries out, or has carried out, the necessary audits.
Our Company pays particular attention to special categories of personal data, since their unlawful processing carries the risk of causing harm or discrimination to individuals. Under Article 6 of the Law, special categories of personal data are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, criminal convictions and security measures, biometric and genetic data, health and sex life.
Apart from the explicit consent of the data subject, personal data processing activities may be based on one or more of the conditions listed below. If the data processed is a special category of personal data, the conditions set out under the next heading apply.
The processing of special categories of personal data is prohibited as a rule. Under Article 6 of the Law as amended by Law No. 7499 of 2 March 2024, our Company processes special categories of personal data only where one of the following conditions exists and the adequate measures determined by the Board are taken:
In accordance with Article 10 of the Law, entitled “Data Controller’s Obligation to Inform”, and the relevant legislation, our Company informs data subjects of who processes their personal data as data controller, for what purposes, with whom and for what purposes it is shared, by what methods it is collected, its legal basis, and the rights of data subjects regarding the processing of their personal data.
For lawful personal data processing purposes, İletim Mühendislik may transfer the personal data and special categories of personal data of data subjects to third parties, taking the necessary security measures. In doing so, our Company acts in accordance with Article 8 of the Law, entitled “Transfer of Personal Data”.
A. Transfer of personal data to third parties resident in Türkiye
Even without the consent of the data subject, personal data may be transferred to third parties by our Company, with due care and with all necessary security measures including the methods prescribed by the Board, where one or more of the following data processing conditions (the “Data Processing Conditions”) exist:
B. Transfer of personal data to third parties resident abroad
Our Company transfers personal data abroad in accordance with Article 9 of the Law as amended by Law No. 7499 of 2 March 2024, as follows.
Personal data may be transferred abroad where one of the processing conditions in Articles 5 and 6 of the Law exists and there is an adequacy decision of the Board regarding the country, the sectors within that country or the international organisation to which the transfer will be made.
In the absence of an adequacy decision, personal data may be transferred where one of the conditions in Articles 5 and 6 exists, provided that the data subject is also able to exercise their rights and to seek effective legal remedies in the destination country, and that one of the following appropriate safeguards is provided by the parties:
Where there is no adequacy decision and none of the appropriate safeguards can be provided, personal data may be transferred abroad only on an occasional basis and only in the cases listed in Article 9(6) of the Law (explicit consent of the data subject after being informed of the possible risks; the transfer being necessary for the performance of a contract between the data subject and the Company or for pre-contractual measures taken at the data subject’s request; the transfer being necessary for the conclusion or performance of a contract between the Company and a third party in the interest of the data subject; an overriding public interest; the establishment, exercise or protection of a right; the protection of life or physical integrity; or a transfer from a register open to the public or to persons with a legitimate interest). The same safeguards apply to onward transfers of personal data transferred abroad and to transfers to international organisations.
C. Transfer of special categories of personal data
Special categories of personal data may be transferred by our Company, in accordance with the principles set out in this Policy and by taking administrative and technical measures, pursuant to Article 8 of the Law where the data subject has given explicit consent or, provided that adequate measures are taken, where one of the processing conditions for special categories of personal data listed above (Article 6(3) of the Law) exists. For transfers abroad, the conditions in section B above also apply.
Within our Company, personal data is processed in line with the purposes arising from the conduct of our business activities, based on and limited to at least one of the Data Processing Conditions, and with regard to the principles set out in Article 4 of the Law, entitled “General Principles”.
Our Company retains personal data for the period required for the purpose for which it is processed and for the minimum period stipulated in the relevant legislation. Our Company first determines whether the relevant legislation stipulates a retention period for personal data and, if so, acts in accordance with that period. If there is no legal period, personal data is retained for as long as necessary for the purpose for which it is processed.
Personal data processed by our Company is processed by category, and maximum retention periods are determined for each category of personal data in line with the relevant data processing process. At the end of the specified retention periods, personal data is disposed of in accordance with the periodic disposal schedule.
The data subject always has the right to access their data. In addition, as owners of personal data, data subjects have the following rights under Article 11 of the Law, entitled “Rights of the Data Subject”:
Data subjects may submit their requests regarding the rights listed above to our Company using the methods determined by the Board. Accordingly, applications may be made to our Company via the e-mail address kvkk@iletimmuhendislik.com.tr. Our Company will conclude such requests free of charge as soon as possible according to the nature of the request, and at the latest within 30 (thirty) days of the application date. However, if the action requires an additional cost, the Company may charge the fee in the tariff determined by the Board.
Our Company takes the necessary administrative and technical measures to conclude applications made by data subjects in accordance with the Law and the relevant legislation.
| Main purposes | Sub-purposes |
| Planning and implementation of the Company’s human resources policies and processes | Conducting recruitment processes |
| Planning human resources processes | |
| Conducting intern and/or student recruitment processes | |
| Planning and implementation of the Company’s commercial and business strategies | Carrying out strategic planning activities |
| Managing relationships with business partners and suppliers | |
| Performance of the work necessary for the conduct of commercial activities by our relevant business units, and conduct of the related business processes | Planning and carrying out business activities |
| Monitoring finance and accounting | |
| Planning and/or carrying out business continuity activities | |
| Establishing and managing the information technology infrastructure | |
| Planning and carrying out the activities required to customise the services offered by the Company according to the preferences, usage habits and needs of data subjects and to recommend them | Planning and carrying out marketing processes for services |
| Performance of the work necessary for data subjects to benefit from the products and services offered by the Company by our business units, and conduct of the related business processes | Planning and/or carrying out after-sales support activities |
| Monitoring contract processes and/or legal claims | |
| Monitoring customer requests and/or complaints |
| Data subject categories | Description |
| Job applicants | Natural persons who have applied for a job with our Company by various means or whose CV has been reviewed by our Company. |
| Internship applicants | Natural persons who have applied for an internship with our Company by various means. |
| Customers | Natural persons who use or have used the services offered by our Company, regardless of whether they have a contractual relationship with our Company. |
| Suppliers | Manufacturers and dealers that supply products, raw materials, etc. so that our Company can offer a service or product. |
| Visitors | Everyone who interacts with our Company — from visitors who take part in our activities or visit our premises for various purposes, to web users who visit our websites, to participants in our events — using our other points of contact. |
| Third parties | Third-party natural persons associated with the parties mentioned above in order to ensure the security of commercial transactions between our Company and those parties, or to protect the rights and interests of those persons. This may include, for example, guarantors, family members and relatives. |
| Employees and officials of institutions we cooperate with | Staff and officials of other institutions with which we have a business relationship. These may include business partners, suppliers, consultants, customers or persons in other business relationships. |
| Personal data categories | Description |
| Identity information | Data containing information about a person’s identity: name and surname, date of birth, place of residence, Turkish identity card information (identity number, serial number, card number, mother’s and father’s names, place of birth, etc.), nationality, gender; documents such as driving licences, identity cards and passports; and information such as tax number, social security number and vehicle registration plate. |
| Contact information | Telephone number, full address, e-mail address, fax number. |
| Customer information | Information obtained and generated about the data subject as a result of our commercial activities and the operations carried out by our business units in this context. |
| Transaction information | Records relating to the use of our services and information such as the customer’s instructions and requests required for the use of the services. |
| Job applicant information | Personal data of individuals who have applied to work for our Company, or whom our Company has evaluated as job applicants suitable for its human resources needs in accordance with commercial practice and good faith. This data may also include military service status, educational background and marital status obtained during the job application. |
| Education information | Records relating to education and training, certificate and diploma information, CVs and similar data. |
| Marital status information | Data such as marital status and date of marriage obtained from employees. |
| Physical premises security information | Personal data obtained on entry to physical premises and during the time spent inside them; this includes camera recordings, fingerprint records and records taken at the security point. |
| Financial information | Personal data processed in relation to information, documents and records showing all kinds of financial results obtained according to the type of legal relationship established with the data subject, such as bank account number, IBAN, credit card information, financial profile, asset data and income information. |
| Security information | Data relating to the recording and retention of camera footage by our Company for security purposes. |
| Special categories of personal data | Data specified in Article 6 of the Law relating to individuals’ membership of associations, foundations or trade unions, religion, pregnancy, health, sex life, criminal convictions and security measures. |
| Request/complaint information | Personal data relating to the receipt and evaluation of all kinds of requests or complaints addressed to our Company. |
| Marketing information | Personal data processed to market our services customised to the data subject’s usage habits, preferences and needs, and reports and evaluations created based on the results of this processing. |
| Other data | Data such as military service deferral, traffic fine inquiry results, clothing size, height, weight, status as a relative of a martyr, shuttle service used, entry and exit logs, internet access logs, etc. |
Update (17 October 2026): the sections on the processing of special categories of personal data, transfers abroad and transfers of special categories of personal data have been updated in line with the amendments made to Law No. 6698 by Law No. 7499.
From 1986 to 1990 it was an organization providing design services only; since 1990 it has continued its commercial activity as a limited company providing design, contracting, consultancy and maintenance services.
Elektromekanik İş Merkezi
626. Sok. No:28B, Alaaddinbey
Nilüfer / Bursa, Türkiye
Tel: +90 224 441 64 04
Fax: +90 224 256 56 02
iletim@iletimmuhendislik.com.tr