INVESTOR RELATIONS

Privacy Notice on the Protection and Processing of Personal Data for Business Partners and Potential Business Partners

As MET-GÜN ENERGY INVESTMENTS INC., in the capacity of 'Data Controller' (hereinafter referred to as 'Data Controller');

We hereby inform you that your personal data, which you have provided to us, will be recorded, stored, maintained, reorganized, and shared with institutions authorized by law to request such personal data, in a limited and proportionate manner, within the framework of the purposes that require their processing. We will ensure the accuracy and currency of your personal data as reported. Additionally, your personal data may be transferred to third parties, both domestic and international, in accordance with the conditions stipulated by the Law on the Protection of Personal Data (KVKK), may be assigned, classified, and processed in other ways specified in the KVKK.

1- Your Processed Personal Data

As the data controller, our company may collect and process certain personal data in accordance with the Law on the Protection of Personal Data No. 6698, which came into effect on April 7, 2016.

Accordingly, we may request the names, surnames, email addresses, phone numbers, and other contact information of individuals working for our business partners or candidate business partners, as well as those who are partners or authorized representatives of the respective companies, depending on the nature of the work.

All personal data collected and processed regarding individuals working for our business partners or candidate business partners, as well as partners or authorized representatives of the respective companies, will be transferred to the relevant units to the extent permitted and stipulated by the Law, as detailed below.

2- Our Method of Collecting Personal Data and Legal Basis

Your personal data is collected by the Data Controller through the channels listed below, in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698, for the purpose of implementing and executing the Data Controller's business development policies. The data is collected in both physical and electronic environments as follows:Information and documents provided to the data controller via email, cargo, references, and similar methods by individuals working for our business partners or candidate business partners, as well as partners or authorized representatives of those companies.

Correspondence conducted via email addresses, sent text messages, multimedia messages, and other communication methods, including information forms and all types of communication channels.

Through references provided by other individuals.

Through the data controller's employees or employment or consultancy companies with which they collaborate.

Collected through research conducted via the internet or other channels by the data controller.

3- Purpose of Processing Your Personal Data

The personal data of individuals who are employees or authorized representatives of our business partners or potential business partners may be collected and processed by the Data Controller within the scope of the purposes specified in this privacy notice as follows: 

  • To apply as needed for business development or the execution of existing work
  • To obtain price quotations related to the tasks to be performed
  • To discuss the details of the received price quotations
  • To create a vendor pool
  • To verify the accuracy of the information provided by individuals working for our business partners or candidate business partners, as well as those who are partners or authorized representatives of the respective companies, or to research the communicated offers by contacting third parties if necessary
  • To comply with the requirements of any relevant legislation or requests from authorized institutions or organizations
  • To develop and improve processes for executing and expediting the work

4- Principles Governing the Processing of Your Personal Data

4.1. Processing of Personal Data in Compliance with the Principles Stipulated in the Legislation

Personal data obtained by the Data Controller is processed in accordance with the procedures and principles stipulated by the Law and other legal regulations. These principles are as follows:

  • Processing in Compliance with Law and the Principle of Integrity
  • Ensuring that Personal Data is Accurate and, When Necessary, Up-to-Date
  • Processing for Specific, Clear, and Legitimate Purposes
  • Being Relevant, Limited, and Proportional to the Purpose for which They are Processed
  • Retaining for the Duration Required by Legislation or Necessary for the Purpose for which They are Processed

4.2. Processing of General Personal Data

Article 5 of the Law regulates the conditions for the processing of personal data. In order for personal data to be processed, at least one of these conditions must be met. It is also possible for a personal data processing activity to meet multiple conditions. Article 6 of the Law regulates the conditions for processing special categories of personal data. The conditions for processing the personal data of job applicants are as follows:

  • Having the Explicit Consent of the Data Subject
  • Clearly Foreseen in the Laws
  • Inability to Obtain the Data Subject's Explicit Consent Due to Actual Impossibility
  • Directly Related to the Establishment or Performance of a Contract
  • Fulfillment of a Legal Obligation
  • The Data Subject Making Their Personal Data Public
  • Necessity of Processing Data for the Establishment or Protection of a Right
  • Necessity of Processing Data for the Legitimate Interests of the Data Controller

4.3. Processing of Special Categories of Personal Data

Article 6 of the Law regulates the conditions for the processing of personal data.

Special categories of personal data are processed by the Data Controller in accordance with the principles specified in this Information Notice, with all necessary administrative and technical measures taken, including methods determined by the Board, and under the following conditions:

The processing of special categories of personal data without the explicit consent of the data subject is prohibited. However, personal data other than health and sexual life may be processed without the explicit consent of the data subject in the cases provided for by law.

Personal data related to health and sexual life may only be processed without the explicit consent of the data subject by individuals or authorized institutions and organizations who are bound by confidentiality obligations for the purposes of protecting public health, conducting preventive medicine, medical diagnosis, treatment, and care services, and planning and managing health services and financing.

Additionally, sufficient measures determined by the Board must be taken in the processing of special categories of personal data.

5- Informing Our Business Partners or Candidate Business Partners, and Individuals Working for or Being Partners/Representatives of Those Companies

According to the Law on the Protection of Personal Data (KVKK), the data controller or the authorized person must inform the relevant individuals during the acquisition of personal data;

  • The identity of the data controller and, if applicable, its representative,
  • The purpose for which the personal data will be processed,
  • To whom and for what purpose the processed personal data may be transferred,
  • The method of collecting personal data and its legal basis,
  • The obligation to inform about the other rights listed in Article 11 of the Law.

The Data Controller fulfills the necessary obligation to inform during the acquisition of personal data and aims to maintain a transparent data processing policy.

6- To Whom and for What Purpose Your Personal Data Will Be Transferred

According to Article 8 of the Law on the Protection of Personal Data No. 6698, personal data cannot be transferred without the explicit consent of the data subject.

Personal data may be transferred to third parties without requiring explicit consent in cases where the personal data can be processed without the explicit consent of the data subject. Similarly, with adequate measures in place, special categories of personal data, other than health and sexual life, may be transferred without requiring the explicit consent of the data subject in cases provided for by law. Personal data related to health and sexual life may only be transferred without the explicit consent of the data subject by individuals or authorized institutions and organizations that are bound by confidentiality obligations, for the purposes of protecting public health, conducting preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing health services and financing. Provisions in other laws regarding the transfer of personal data remain reserved.

According to Article 9 of the KVKK, titled 'Transfer of Personal Data Abroad,' personal data cannot be transferred abroad without the explicit consent of the data subject, as a rule. However, personal data may be transferred to third parties without requiring explicit consent in cases where personal data can be processed without explicit consent. Similarly, with adequate measures in place, special categories of personal data, other than health and sexual life, may be transferred abroad without requiring the explicit consent of the data subject in cases provided for by law.

Personal data related to health and sexual life may only be transferred abroad without the explicit consent of the data subject by individuals or authorized institutions and organizations that are bound by confidentiality obligations, for the purposes of protecting public health, conducting preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing health services and financing.

In order for personal data to be transferred abroad without the explicit consent of the data subject, there must also be sufficient protection in place. If there is no adequate protection, both the data controllers in Turkey and the relevant foreign country must provide a written commitment for sufficient protection, and the permission of the Board must be obtained. Countries with adequate protection will be determined and announced by the Board. Provisions in other laws regarding the transfer of personal data abroad remain reserved.

Personal data processed in accordance with the above-mentioned regulations may be transferred to the following categories of individuals:

  • To the business partners involved,
  • To company officials,
  • To legally authorized public institutions and organizations,
  • To legally authorized private law entities, 

Personal data may be transferred within the limits of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law on the Protection of Personal Data No. 6698.

7- Retention Period of Your Personal Data

When determining the retention period of personal data, the obligations imposed by legal regulations are taken into consideration. Aside from legal regulations, the purposes for processing personal data are also considered when establishing the retention period. After the duration mentioned here has elapsed, your personal data will be deleted, destroyed, and/or anonymized by the Data Controller or upon your request, in accordance with the Law on the Protection of Personal Data, relevant regulations, and the methods outlined in the Data Controller's data retention and destruction policy.

The personal data processed by the Data Controller regarding our business partners or candidate business partners, as well as individuals working for or being partners/authorized representatives of those companies, will be retained for the duration of the contract and for 15 years after its termination for our business partners. For candidate business partners and their employees or partners/authorized representatives, the information will be retained for three years from the date of acquisition. In the event that a business relationship cannot be established with the relevant individuals, the data will be deleted, destroyed, and/or anonymized using the methods outlined in the Data Controller's data retention and destruction policy.

You can always withdraw your consent for the processing of personal data, except for those that must be processed by law.

8- Your Rights as a Data Subject

Under Article 11 of the Law on the Protection of Personal Data (KVKK), you have the following rights regarding your personal data:

  • To learn whether your personal data is being processed,
  • To request information regarding your processed personal data,
  • To learn the purpose of processing personal data and whether they are used in accordance with that purpose,
  • To know the third parties to whom your personal data is transferred, either domestically or internationally,
  • To request correction of your personal data if it has been processed incompletely or inaccurately,
  • To request the deletion or destruction of your personal data when the reasons for processing no longer exist,
  • To request that your corrected or deleted information, if it has been transferred, be notified to the third parties to whom your personal data has been transferred,
  • To object to a result that is generated against you solely by automated systems through the analysis of processed data,
  • To request compensation for damages incurred due to unlawful processing of your personal data.

To exercise the above-mentioned rights, you can submit your written request along with the necessary information to identify your identity and explanations regarding the right you wish to exercise, clearly stating that the matter  pertains to the KVKK, to the following address: 'Huzur Mah. Ayazağa Cad. Metgün Binası No:2/2 Sarıyer / Istanbul.' You may deliver it in person with a wet signature, send it via notary, or use other methods specified in the Law No. 6698. Applications must be made in Turkish.