English
TürkçeHome Personal Data Protection Supplier Privacy Notice
Supplier Privacy Notice.
Privacy notice for suppliers on the processing of personal data.
This English text is a translation provided for information. The Turkish text is the original and prevails in case of any discrepancy.
Supplier Privacy Notice on the Processing of Personal Data
Dear Supplier;
This privacy notice has been prepared by TSY Enerji Endüstrisi Sanayi ve Ticaret Anonim Şirketi, acting as data controller, within the framework of Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, in order to inform you, our suppliers who are natural persons and/or the authorised representatives and employees of our suppliers that are legal entities, about the purposes and legal grounds for processing your personal data, the methods of collection, to whom it may be transferred and your rights under the KVKK.
1. Which Personal Data Do We Process?
| Personal Data Processed | First name, surname, Turkish ID number, tax identification number for sole proprietorships, signature. |
|---|---|
| Collection Methods and Sources | Directly from the data subject, through contracts, quotations, orders, supplier registration/forms and documents submitted; from persons authorised by the supplier that is a legal entity. |
| Processing Purposes | Conducting finance and accounting affairs, following up and conducting legal affairs, conducting communication activities, conducting logistics activities, conducting procurement processes for goods / services, conducting storage and archiving activities, conducting contract processes, conducting supply chain management processes, ensuring the security of data controller operations, providing information to authorised persons, institutions and organisations. |
| Legal Grounds | KVKK Art. 5/2-a — expressly provided for by law; Art. 5/2-c — directly related to the conclusion or performance of a contract; Art. 5/2-ç — mandatory for the fulfilment of a legal obligation; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Competent public institutions and organisations; law firms, financial advisers, banks, cargo/logistics service providers. Accounting software, our other suppliers of goods and services |
| Transfer Purposes | Conclusion/performance of the contract; payment and financial processes, conducting legal processes, dispatch of goods/documents, notifications arising from legislation, coordination of business activities. |
| Personal Data Processed | Telephone number, full address, e-mail address. |
|---|---|
| Collection Methods and Sources | Directly from the data subject, from contract, quotation, order and supplier communication processes; by e-mail/telephone and through corporate systems. |
| Processing Purposes | Conducting finance and accounting affairs, following up and conducting legal affairs, conducting communication activities, conducting logistics activities, conducting procurement processes for goods / services, conducting storage and archiving activities, conducting contract processes, conducting supply chain management processes, ensuring the security of data controller operations, providing information to authorised persons, institutions and organisations. |
| Legal Grounds | KVKK Art. 5/2-a — expressly provided for by law; Art. 5/2-c — directly related to the conclusion or performance of a contract; Art. 5/2-ç — mandatory for the fulfilment of a legal obligation; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Competent public institutions and organisations; law firms, financial advisers, banks, cargo/logistics service providers. |
| Transfer Purposes | Communication and operational coordination; dispatch of goods/documents; conducting contract and supply processes. |
| Personal Data Processed | Where the representative/employee comes to our company on assignment, your social security (SGK) employment entry declaration, occupational health and safety training certificates, etc. |
|---|---|
| Collection Methods and Sources | Collected by automated, partially automated and — provided they form part of a data recording system — non-automated means, such as e-mails or documents sent by the supplier’s representative. |
| Processing Purposes | Conducting activities in compliance with legislation, conducting supply chain management processes, conducting occupational health / safety activities, conducting storage and archiving activities, ensuring the security of data controller operations, providing information to authorised persons, institutions and organisations |
| Legal Grounds | KVKK Art. 5/2-a — expressly provided for by law; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Customers [only if mandatory for qualification/operations]; competent public institutions |
| Transfer Purposes | Legitimate interest of the data controller, supply chain management processes, |
| Personal Data Processed | Information in correspondence with judicial/administrative authorities, information in lawsuit and dispute files. |
|---|---|
| Collection Methods and Sources | Company records; the data subject/supplier; judicial and administrative authorities, contracted law firms. |
| Processing Purposes | Following up and conducting legal affairs, conducting activities in compliance with legislation, providing information to authorised persons, institutions and organisations. |
| Legal Grounds | KVKK Art. 5/2-a — expressly provided for by law; Art. 5/2-c — directly related to the conclusion or performance of a contract; Art. 5/2-e — mandatory for the establishment, exercise or protection of a right; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Law firms; courts, public prosecutors’ offices and other competent public institutions and organisations. |
| Transfer Purposes | Following up legal disputes; establishing, exercising or protecting rights; responding to official requests. |
| Personal Data Processed | Work experience, education, diploma and professional qualification information |
|---|---|
| Collection Methods and Sources | Direct statement of the data subject/supplier that is a legal entity; quotation, qualification and supplier evaluation documents. |
| Processing Purposes | Conducting supplier evaluation and supply chain management processes; conducting procurement processes for goods/services; conducting activities in compliance with legislation. |
| Legal Grounds | KVKK Art. 5/2-c — directly related to the conclusion or performance of a contract; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Customers [only if mandatory for qualification/operations]; competent public institutions |
| Transfer Purposes | Assessing the professional competence of the supplier/its representative; fulfilling operational and contractual obligations. |
| Personal Data Processed | Payment information, invoice information, bank account number information, number of instalments, cheque information, credit and risk information, etc. |
|---|---|
| Collection Methods and Sources | Direct statement of the data subject/supplier that is a legal entity; quotations and supplier documents. |
| Processing Purposes | Conducting supplier evaluation and supply chain management processes; conducting procurement processes for goods/services; conducting activities in compliance with legislation, conducting finance and accounting affairs, conducting the remuneration policy. |
| Legal Grounds | KVKK Art. 5/2-c — directly related to the conclusion or performance of a contract; Art. 5/2-f — legitimate interest of the data controller. |
| Recipient Groups | Business partners and customers [only if mandatory for qualification/operations]; competent public institutions [if required by legislation], financial advisers, law firms. |
| Transfer Purposes | Assessing the professional competence of the supplier/its representative; fulfilling operational and contractual obligations. |
2. For What Purposes Do We Process Your Personal Data?
Your personal data listed above will be processed, recorded, stored, preserved and classified for the processing purposes stated under each data category.
3. To Whom and for What Purposes Do We Transfer Your Personal Data?
The recipient groups to which your personal data may be transferred and the purposes of such transfers are shown in the tables above for each data category.
4. What Are the Methods of Collecting Your Personal Data and the Related Legal Grounds?
The methods and sources from which your personal data is obtained and the legal grounds on which it is processed are shown in the tables above for each data category.
Within the scope of the purposes stated in this Privacy Notice, your personal data will, in accordance with the General Principles listed in Article 4 of the KVKK, be:
- a) in compliance with the law and the rules of good faith,
- b) accurate and, where necessary, kept up to date,
- c) for specified, explicit and legitimate purposes,
- d) relevant, limited and proportionate to the purposes for which it is processed,
- e) retained for the period stipulated in the relevant legislation or required for the purpose for which it is processed,
and will be processed, recorded, stored, preserved and classified by automated means or, provided that they form part of a data recording system, by non-automated means and, where necessary, may be transferred to the recipient groups stated in the tables above.
5. What Are Your Rights Regarding the Processing of Personal Data and How Can You Exercise Them?
Article 20 of the Constitution provides that everyone has the right to be informed about personal data concerning them. Article 11 of the KVKK lists the rights of the data subject under the law.
You may submit your requests concerning your rights under the KVKK to TSY Enerji Endüstrisi Sanayi ve Ticaret Anonim Şirketi, in accordance with Article 5 of the “Communiqué on the Procedures and Principles of Application to the Data Controller”, in writing or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature or the e-mail address previously notified to the data controller by the data subject and registered in the data controller’s system.
Data Controller
Data Controller: TSY Enerji Endüstrisi Sanayi ve Ticaret Anonim Şirketi
Address: Köşklü Çeşme Mah. 563. Sk. No: 17 İç Kapı No: 1 Gebze / Kocaeli
E-mail: kvkk@tsyenergy.com
Kep: tsyenerji@hs01.kep.tr