Protection of Personal Data

TEMPA PANO

Personal Data Protection and Processing Policy

Tempa Pano San. ve Tic. A.Ş. corporate privacy framework

This policy explains Tempa Pano’s core principles for personal data processing, data categories, purposes, disclosures, retention and data subject rights. Detailed internal procedures, records of processing, technical security controls and destruction logs are managed separately from this public policy.

 1. Purpose and Scope

The purpose of this Policy is to explain Tempa Pano’s corporate approach to collecting, using, retaining, disclosing, protecting and, where required, deleting, destroying or anonymising personal data in accordance with Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable secondary legislation.

The Policy applies to customers, prospective customers, suppliers, business partners and their employees/representatives, website visitors, job applicants and other individuals whose personal data is processed in connection with Tempa Pano’s activities.

2. Core Principles

• Processing lawfully and fairly.
• Keeping data accurate and, where necessary, up to date.
• Processing for specified, explicit and legitimate purposes.
• Keeping processing relevant, limited and proportionate to the purpose.
• Retaining data only for the period required by law or the processing purpose.
• Applying appropriate technical and organisational measures to preserve confidentiality, integrity and availability.

3. Main Data Categories

 4. Processing Purposes

• Managing product, quotation, sales, project and customer relationship processes.
• Managing supplier/business partner relationships, contracts and operational communications.
• Assessing job applications and managing human resources processes.
• Operating and securing the website and digital services and, where permitted, improving performance.
• Complying with financial, commercial, administrative and legal obligations.
• Establishing, exercising and protecting rights and managing disputes and audits.
• Managing information security, business continuity, audit and internal control processes.

5. Legal Grounds

Personal data is processed on the processing condition under Article 5 of KVKK that is appropriate to the specific activity; special categories are processed under the conditions in Article 6. Tempa Pano does not rely on consent as a blanket or mandatory basis where another lawful condition is available.

• Processing expressly required by law or necessary to comply with a legal obligation.
• Processing directly related to the establishment or performance of a contract.
• Processing necessary for the establishment, exercise or protection of a right.
• Legitimate interests of the data controller, provided the fundamental rights and freedoms of the individual are not harmed.
• Explicit consent only where necessary, specific, informed and freely given.

6. Collection Channels

Data may be collected through the website and forms, corporate email, telephone, face-to-face communications, contracts, quotation/order processes, job applications, server/security logs, the cookie preference system and direct submissions by the individual or an authorised third party.

7. Disclosures and International Transfers

Tempa Pano may disclose personal data, strictly on a need-to-know and purpose-limited basis, to relevant internal departments; processors providing hosting, website maintenance, cyber-security or corporate IT services; suppliers/business partners where required for the relevant activity; professional advisers; and legally authorised public bodies.

Where regular cross-border transfers occur, the current system under Article 9 of KVKK is applied. In the absence of an adequacy decision, standard contractual clauses or other safeguards/derogations permitted by law are assessed and applicable notification and record-keeping obligations are fulfilled.

8. Website and Cookies

Cookies and similar technologies may be used for security and strictly necessary website functions. Where required, explicit consent is obtained for analytics and other non-essential technologies. The Cookie Policy explains the categories used and known third-party services.

9. Special Categories of Personal Data

Special categories are processed only where the conditions under Article 6 of KVKK are met and to the extent required by the purpose. Tempa Pano applies access restrictions, authorisation, confidentiality, secure transfer and appropriate technical/organisational safeguards. Job applicants should avoid providing special-category information that is not relevant to the application.

10. Data Security

• Limiting access and privileges on a role- and need-to-know basis.
• Applying appropriate authentication, password and access controls to corporate systems.
• Implementing update, backup, logging, network and endpoint security measures.
• Binding processors to contractual data protection obligations and reviewing them to a reasonable extent.
• Maintaining incident response and notification processes for personal data breaches.
• Applying staff awareness, confidentiality and data minimisation principles.

11. Retention and Disposal

Personal data is retained for the periods required by law and for as long as necessary for the purpose. At the end of the relevant period, data is deleted, destroyed or anonymised using an appropriate method. Detailed retention periods are managed through Tempa Pano’s internal records and retention/destruction procedures.

• Job applications/CVs: up to 6 months after completion of the recruitment process unless a longer period is required by a lawful reason.
• Website and security logs: for a reasonable period required for security, incident review and technical operations.
• Commercial and contractual records: for the applicable commercial, tax and legal retention/limitation periods.

12. Data Subject Rights

Individuals may exercise their rights under Article 11 of KVKK. Requests may be submitted with sufficient verification information to [email protected] or in writing to Makine İhtisas OSB., Demirciler Neighborhood, 2nd Avenue No:1, 41455 Dilovası / Kocaeli / Türkiye.

13. Governance and Responsibility

Tempa Pano departments and authorised staff processing personal data must comply with this Policy. Processors may process personal data disclosed to them only in accordance with Tempa Pano’s instructions, the relevant contract and applicable law.

14. Updates

This Policy is reviewed when applicable law, business processes or technologies change. The current public version is published on www.tempapano.com.