This English version is provided for information purposes only. In the event of any discrepancy between the English and Turkish versions, the Turkish version shall prevail.
1.1. General
Ensuring the confidentiality and security of your personal data is among the highest priorities of PROSES TİCARET, İMALAT, MÜHENDİSLİK ENDÜSTRİYEL MADDE VE MALZEME İMALATI İNŞAAT VE SANAYİ LİMİTED ŞİRKETİ (the “Company”). The purpose of this Personal Data Processing and Protection Policy (the “Policy”) and of the processes governed by the Company’s other written policies is to ensure that the personal data of the individuals whose data we process (“Data Subjects”) are processed and protected lawfully, and that Data Subjects are informed accordingly.
1.2. Purpose and Scope of the Policy
The main purpose of this Policy is to explain the personal data processing activities the Company carries out in accordance with the law and the systems adopted to protect personal data, and to inform Data Subjects accordingly. This Policy covers all personal data of Data Subjects that are processed by fully or partly automated means, or by non-automated means provided that they form part of a data filing system.
1.3. Application of the Policy and Relevant Legislation
This Policy has been prepared within the framework of the principles set out in the relevant legislation. The Company undertakes and accepts that, in the event of any inconsistency between the legislation in force and this Policy, the legislation in force shall apply.
2. DEFINITIONS AND ABBREVIATIONS
• Explicit Consent: Consent relating to a specific matter, based on information and given freely.
• Constitution: The Constitution of the Republic of Türkiye of 1982.
• Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even when matched with other data.
• Employee: Employees of PROSES TİCARET, İMALAT, MÜHENDİSLİK ENDÜSTRİYEL MADDE VE MALZEME İMALATI İNŞAAT VE SANAYİ LİMİTED ŞİRKETİ.
• Job Applicant: Natural persons who have applied for a job at PROSES TİCARET, İMALAT, MÜHENDİSLİK ENDÜSTRİYEL MADDE VE MALZEME İMALATI İNŞAAT VE SANAYİ LİMİTED ŞİRKETİ by any means or have submitted their CV and related
information.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Data Subject / Relevant Person: The natural person whose personal data are processed.
• Processing of Personal Data: Any operation performed on personal data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, takeover, making available, classification or prevention of use, whether by fully or partly automated means or by non-automated means provided that they form part of a data filing system.
• Board: The Personal Data Protection Board.
• Authority: The Personal Data Protection Authority
• KVKK: Personal Data Protection Law No. 6698
• Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Periodic Destruction: The deletion, destruction or anonymization carried out ex officio at recurring intervals specified in the personal data retention and destruction policy, when all conditions for processing personal data set out in the Law have ceased to exist.
• Policy: The PROSES TİCARET, İMALAT, MÜHENDİSLİK ENDÜSTRİYEL MADDE VE MALZEME İMALATI İNŞAAT VE SANAYİ LİMİTED ŞİRKETİ Personal Data Processing and Protection Policy.
• Data Controller Application Form: The form Data Subjects use when exercising their rights under Article 11 of the KVKK.
• Data Processor: A natural or legal person who processes personal data on behalf of the data controller under the authority granted by the data controller.
• Data Filing System: A filing system or index in which personal data are structured and processed according to specific criteria.
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
3. PRINCIPLES FOR PROCESSING PERSONAL DATA
3.1. Processing Personal Data in Line with the Principles Set Out in the Legislation
3.1.1. Processing Lawfully and Fairly
The Company has adopted lawfulness and fairness as a core principle in every operation performed on personal data and, in line with the principle of transparency, informs Data Subjects about the purposes for which their personal data are collected.
3.1.2. Ensuring Personal Data Are Accurate and, Where Necessary, Up to Date
When processing personal data, the Company has systems and processes in place to ensure the accuracy and currency of the data it processes. Data Subjects may contact the Company to help keep their personal data accurate and up to date at all times.
3.1.3. Processing for Specific, Explicit and Legitimate Purposes
The Company clearly defines the purposes of personal data processing within legitimate and lawful limits.
3.1.4. Being Relevant, Limited and Proportionate to the Purposes of Processing
The Company processes personal data only for purposes related to its field of activity and necessary for conducting its business. Accordingly, it avoids processing personal data that are not relevant to achieving the purpose or that are not needed now or in the future.
3.1.5. Retaining Data for the Period Required by the Relevant Legislation or Necessary for the Purpose of Processing
The Company retains personal data only for the period specified in the relevant legislation or necessary for the purpose for which they are processed.
3.2. Processing Personal Data Based on, and Limited to, One or More of the Processing Conditions in Article 5 of the KVKK
The Company processes personal data only on the basis of the explicit consent of the data subject or, without explicit consent, in the cases where the law states that explicit consent is not required.
Cases in which explicit consent is not required:
a) It is expressly provided for by law,
b) Explicit consent cannot be obtained due to actual impossibility,
c) Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract,
d) It is mandatory for the Company to fulfil its legal obligations,
e) The personal data have been made public by the data subject,
f) Data processing is mandatory for the establishment, exercise or protection of a right,
g) Data processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
3.3. Processing Special Categories of Personal Data
Because of the risk of causing harm or discrimination when processed unlawfully, personal data designated as “special categories” by the KVKK are addressed separately in this Policy, reflecting the Company’s sensitivity toward such data. Where the data subject has not given consent, the Company may process special categories of personal data only in the following cases, provided that adequate measures determined by the Board are taken:
a) Special categories of personal data other than those relating to health and sexual life, in the cases provided for by law,
b) Special categories of personal data relating to health and sexual life only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing, by persons under a duty of confidentiality or by authorized institutions and organizations, without seeking the explicit consent of the data subject.
3.4. Transfer of Personal Data
To fulfil the purposes set out in this Policy, your personal data may be transferred, within the framework of the processing conditions and purposes set out in Articles 8 and 9 of the KVKK, to our other organizations, to supervisory bodies in the course of audit activities, to our shareholders, to our group companies, to legally authorized public institutions and organizations, to our suppliers and business partners, to our foreign legal entity partners, to companies providing cloud services for storage and backup, to persons from whom we receive services or third parties to whom we provide services, and/or abroad.
4. PRINCIPLES FOR PROTECTING PERSONAL DATA
4.1. Technical and Administrative Measures Taken to Ensure Lawful Processing and Retention of Personal Data and to Prevent Unlawful Access
4.1.1. Technical Measures
The main technical measures taken by the Company to ensure the lawful processing and retention of personal data and to prevent unlawful access to personal data are as follows:
• Network security and application security are ensured.
• A closed network is used for transfers of personal data over networks.
• Key management is applied.
• Security measures are taken for the procurement, development and maintenance of information technology systems.
• The security of personal data stored in the cloud is ensured.
• An authorization matrix has been created for employees.
• Access logs are kept regularly.
• Data masking is applied where necessary.
• The access rights of employees who change roles or leave the company are revoked.
• Up-to-date antivirus systems are used.
• Firewalls are used.
• Additional security measures are taken for personal data transferred on paper, and related personal data security issues are reported promptly.
• Personal data security is monitored.
• Necessary security measures are taken for entry to and exit from physical environments containing personal data.
• Physical environments containing personal data are protected against external risks (fire, flood, etc.).
• The security of environments containing personal data is ensured.
• Personal data are minimized as far as possible.
• Personal data are backed up, and the security of backed-up personal data is ensured.
• A user account management and authorization control system is applied and monitored.
• Periodic and/or random internal audits are carried out or commissioned.
• Log records are kept in a way that prevents user intervention.
• Existing risks and threats have been identified.
• If special categories of personal data are to be sent by email, they are always sent encrypted and
• using a registered electronic mail (KEP) or corporate email account.
• Secure encryption / cryptographic keys are used for special categories of personal data and are managed by different units.
• Intrusion detection and prevention systems are used.
• Penetration tests are performed.
• Cybersecurity measures have been taken and their implementation is continuously monitored.
• Special categories of personal data transferred on portable memory, CD or DVD are encrypted.
• Data loss prevention software is used.
4.1.2. Administrative Measures
The main administrative measures taken by the Company to ensure the lawful processing and retention of personal data and to prevent unlawful access to personal data are as follows:
• Disciplinary regulations containing data security provisions are in place for employees.
• Training and awareness activities on data security are carried out for employees at regular intervals.
• Corporate policies on access, information security, use, retention and destruction have been prepared and implemented.
• Documents are sent in a confidentiality-classified document format.
• Personal data security policies and procedures have been established.
• Protocols and procedures for the security of special categories of personal data have been established and are applied.
• Data processing service providers are audited at regular intervals with regard to data security.
• Awareness of data security is ensured among data processing service providers.
• Our employees are informed and trained on personal data protection law and the lawful processing of personal data.
• Contracts and documents governing the legal relationship between the Company and its employees include provisions obliging employees not to process, disclose or use personal data except as instructed by the Company and in cases of legal exceptions, and employee awareness on this matter is increased.
• To meet the legal compliance requirements identified for each business unit, awareness is raised and implemented within the relevant units. The administrative measures needed to audit these matters and ensure continuity are implemented through internal policies and training.
• Access and authorization processes for personal data are designed and implemented in line with business unit–specific legal compliance requirements.
• Contracts concluded with third parties to whom the Company lawfully transfers personal data include provisions requiring them to take the necessary security measures to protect the transferred personal data and to ensure that these measures are followed within their own organizations.
4.2. Protection of Special Categories of Personal Data
The Company carefully protects personal data designated as special categories by the KVKK and processed lawfully. Accordingly, the technical and administrative measures taken by the Company to protect personal data are applied with particular care to special categories of personal data.
5. DATA SUBJECT APPLICATIONS TO THE DATA CONTROLLER, OUR CONTACT CHANNELS AND THE APPLICATION REVIEW PROCESS
5.1. Subject of the Application
The Company places great importance on the rights of Data Subjects and makes it easy for them to exercise these rights. For this purpose, the Company has prepared a Data Controller Application Form, published on our website, through which Data Subjects can easily submit their requests.
By applying to the Company, everyone has the right to:
a) Learn whether their personal data are being processed,
b) Request information if their personal data have been processed,
c) Learn the purpose of processing their personal data and whether they are used in line with that purpose,
ç) Know the third parties in Türkiye or abroad to whom their personal data are transferred,
d) Request the correction of personal data that are incomplete or inaccurately processed,
e) Request the deletion or destruction of personal data under the conditions set out in Article 7 of the KVKK,
f) Request that operations carried out under subparagraphs (d) and (e) be notified to third parties to whom the personal data have been transferred,
g) Object to a result arising against them through the analysis of processed data exclusively by automated systems,
ğ) Claim compensation for damages arising from the unlawful processing of their personal data.
5.2. Application Method and Address
The contact channels and method for exercising the rights above are provided in the Data Controller Application Form on our website, www.prosestim.com.
5.3. Process After Application
Applications submitted to us are answered, depending on the nature of the request, within 30 (thirty) days at the latest from the date the request is received. Our responses are sent using the notification method specified by the applicant in the Data Controller Application Form.
5.4. Application Fee
As a rule, applications are free of charge. However, if the operation requested by the data subject involves an additional cost, the Company will charge the fee set out in the tariff determined by the Board.
6. INFORMING DATA SUBJECTS
In accordance with Article 10 of the KVKK, the Company informs Data Subjects about the collection of their personal data through this Policy, the Privacy Notice easily accessible on our website, and other documents.
7. RETENTION PERIODS FOR PERSONAL DATA
Where the relevant legislation provides for it, the Company retains personal data for the period specified in that legislation. If the purpose of processing has ended and the retention period set by the relevant legislation and the Company has also expired, personal data may be retained only to serve as evidence in possible legal disputes or to assert a right related to the personal data. In determining these periods, the statutory limitation periods for asserting the right in question are taken as the basis. In this case, personal data are not accessed for any other purpose. Personal data are destroyed once these periods have expired.
8. PERSONAL DATA PROCESSING ACTIVITIES IN OUR BUILDINGS AND FACILITIES
8.1. CCTV Monitoring at and Inside Building and Facility Entrances
To ensure the security of our customers, visitors, employees, the people we serve and the Company, and to prevent crime, the Company processes personal data through security cameras installed at the entrances to and inside the premises, buildings and facilities where we provide our services, and by monitoring entries and exits.
8.2. Informing Data Subjects About CCTV Monitoring
In accordance with Article 10 of the KVKK, the Company informs Data Subjects in order to prevent harm to their fundamental rights and freedoms and to ensure transparency. Regarding CCTV monitoring, the Company provides information both through this Policy on its website (online Policy) and through notices posted at the entrances to monitored areas.
8.3. Personal Data Processing Activities in Call Center Services
If you contact our call center, we process your personal data to receive, evaluate and resolve your questions, requests, complaints and suggestions and to ensure customer satisfaction.
The name, surname, telephone number and voice recording shared by those who call PROSES T.İ.M are processed solely for the following purposes:
These personal data are processed automatically by telephone on the legal basis set out in Article 5 of Personal Data Protection Law No. 6698, namely that “data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,” and will be shared with the relevant judicial authorities only upon request in legal disputes. You may submit your requests under Article 11 of the Law, which sets out the rights of data subjects, to PROSES T.İ.M in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller.
Musa Gündüz Cad. No:14 Taşköprü / Çiftlikköy / Yalova, Türkiye
This privacy notice has been prepared by Fatih Gürbüz in the capacity of data controller, under Article 10 of Personal Data Protection Law No. 6698 and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
Video recordings are made through a total of 60 security cameras located at the entrance doors, building exterior, parking lot, security/reception area, floor corridors, elevators, floor entrances, production areas, storage area, meeting room and offices inside our company building, for the purpose of ensuring building security, and the recording process is supervised by the General Management unit.
These personal data are processed by automated means on the legal bases set out in Article 5 of the Law, namely that “processing is mandatory for the data controller to fulfil its legal obligations” and that “data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.”
These personal data may be transferred to judicial authorities or the relevant law enforcement agencies to resolve legal disputes or upon request under the relevant legislation.
You may submit your requests under Article 11 of the Law, which sets out the rights of data subjects, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, in writing to Musa Gündüz Caddesi No: 14, Taşköprü Mahallesi, Yalova, or by email from the email address registered with us to [email protected] or [email protected].
This section explains which cookies prosestim.com uses, why we use them and how you can manage your preferences. The data controller is Proses Ticaret, İmalat, Mühendislik Endüstriyel Madde ve Malzeme İmalatı İnşaat ve Sanayi Limited Şirketi.
Apart from cookies that are strictly necessary for the website to work, we use cookies only with your explicit consent. Declining does not affect the website’s core functions.
Last updated: October 28, 2026
What are cookies?
Cookies are small text files that a website stores on your device through your browser. On your next visit, the website reads them to remember things such as your language preference. Information stored for the same purpose in your browser’s local storage (localStorage) is also covered by this policy.
Cookies by duration
Session cookies are deleted when you close your browser. Persistent cookies stay on your device for the period stated below or until you delete them.
Cookies by who sets them
First-party cookies are set directly by prosestim.com. Third-party cookies are set by a service provider whose content we display on our website (for example, Google Maps on the Contact page).
1. Strictly necessary cookies (no consent required)
Required for the website to work properly; if they are disabled, some features will not work.
2. Third-party content (with your explicit consent)
Cookies we do not use
We do not use analytics, advertising or remarketing cookies. The LinkedIn, Instagram, YouTube and WhatsApp icons at the bottom of the page are plain links; these services do not set cookies on your device unless you click them. Session cookies for site administrators are set only for people who log in to the admin panel, never for visitors.
On your first visit, a consent banner asks about non-essential cookies; you can choose “Accept” or “Decline”. You can change your choice or withdraw your consent at any time using the Cookie settings link at the bottom of the page. We ask again after 12 months.
You can also delete or block cookies in your browser settings:
If you block strictly necessary cookies, your language and cookie choices may not be remembered.
We update this section whenever the cookies used on the website change. Changes take effect on the date they are published. In the event of any discrepancy between the English and Turkish versions, the Turkish version shall prevail.
Under Article 11 of the KVKK, data subjects have the right to:
• Learn whether their personal data are being processed,
• Request information if their personal data have been processed,
• Learn the purpose of processing their personal data and whether they are used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom their personal data are transferred,
• Request the correction of personal data that are incomplete or inaccurately processed, and request that this be notified to third parties to whom the personal data have been transferred,
• Request the deletion or destruction of personal data if the reasons for processing no longer exist, even though they were processed in accordance with the KVKK and other relevant laws, and request that this be notified to third parties to whom the personal data have been transferred,
• Object to a result arising against them through the analysis of processed data exclusively by automated systems,
• Claim compensation for damages arising from the unlawful processing of their personal data.
You can submit your requests regarding these rights to the Company by completing the Data Subject Application Form available at Data controller application form. Depending on the nature of your request, your application will be finalized free of charge as soon as possible and within thirty days at the latest; however, if the operation involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.
Accounting
Copy our registered company name, tax and e-invoice details with one click using the button on each row.
Invoice name (registered company name)
Please send BA/BS forms, current account reconciliations and any other emails for our Finance and Administrative Affairs Department to [email protected].
