KVKK Clarification Notice (Employees)

The purpose of this Disclosure Text ("Text") is to explain the scope and legal reasons for which the personal data of employees ("Employee") of companies using the Platform within the scope of the cloud-based Personnel Attendance Control System ("Platform") offered under the Work24 brand is processed by Demirkanlı Makine İnşaat San. Ve Tic A.Ş.

1. DATA CONTROLLER AND DATA PROCESSOR ROLES

The actual Data Controller of employee data processed through the Platform is your employer company that manages its own personnel attendance control processes by using the Platform.

In this context, Work24;

Within the framework of the contract and instructions concluded with your employer

For the purpose of hosting, operating, updating, maintaining and providing support services of the Platform

mostly acts as a "data processor"; however, it also processes personal data as a data controller in limited cases required for its own system security, log records and compliance with legislation.

2. PROCESSED PERSONAL DATA AND SOURCE

Your personal data processed within the scope of the Platform basically consists of data entered into the system by your employer or automatically generated by the system. The main data categories within this scope are:

Identity and Employee Information Name, surname, personnel registration number, shift information, workplace/branch information, etc.

Contact Information Email address, mobile phone

Working Hours and Attendance Information Check-in and check-out times, shift start/end times, overtime, reported absences and leave records, break records, etc.

Location Data Instant location information used for check-in/check-out or location-based verification depending on the usage scenario selected by your employer (if any and if the relevant feature is active in the system)

Device and Usage Information Username, session and transaction records created during mobile application/portal use, device model, operating system information, etc.

Log and Transaction Security Data Access date-time information, transactions performed, error logs, security records, etc.

A significant portion of this data is processed for the purpose of managing in digital environment through the Platform the data that your employer already processes in its human resources and/or payroll processes.

3. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed primarily for your employer to carry out its labor law, payroll and human resources processes, and by Work24 for the following purposes in a limited and measured manner:

Installation, configuration and commissioning of the Platform

Creation, authorization and management of user accounts

Processing, reporting and ensuring transfer to employer systems of check-in/check-out, shift and working hours information

Monitoring system performance, providing maintenance and support services

Keeping log records for security, error detection and prevention of unauthorized access

Execution of backup and business continuity processes

Storage of records for the purpose of constituting evidence in possible disputes

Fulfillment of obligations arising from relevant legislation (e.g., sharing with authorized institutions when requested)

Work24 does not use employee data processed through the Platform on its own for purposes such as payroll, performance, discipline; such evaluations are carried out within the scope of your employer's own processes and under its own responsibility.

4. TRANSFER OF PERSONAL DATA

Your employee personal data;

To hosting and infrastructure service providers for the purpose of hosting, managing and backing up the Platform

To companies from which we receive software and technical support services for the maintenance and development of systems

To our legal advisors and authorized judicial authorities in case of possible disputes

To authorized public institutions and organizations in cases and within limits foreseen in the legislation

may be shared.

When these transfers are made, necessary technical and administrative security measures are taken within the framework of Articles 8 and 9 of KVKK.

In case of transfer abroad, action is taken within the framework of contracts made with relevant cloud/infrastructure providers and Board decisions.

5. METHODS OF COLLECTING PERSONAL DATA AND LEGAL REASONS

Your personal data;

Employee data transferred to the Platform by your employer

Transaction and log records created during your use of the Platform

Transactions made through mobile application or web portal

Records transferred from your employer's systems through integrations

is obtained through automatic means.

This data; in accordance with Article 5 of KVKK;

Being directly related to the establishment or performance of a contract (Art. 5/2-c)

Being necessary for the data controller to fulfill its legal obligation (Art. 5/2-ç)

Data processing being necessary for the establishment, exercise or protection of a right (Art. 5/2-e)

Protection of our legitimate interests and your employer's legitimate interests (Art. 5/2-f)

is processed based on legal reasons.

In cases where these legal reasons are not sufficient, your explicit consent may be requested separately for relevant cases.

6. RETENTION PERIOD OF PERSONAL DATA

Work24 stores employee data processed within the scope of the Platform;

As long as the contractual relationship with your employer continues

For the periods of limitation and retention obligations foreseen in relevant legislation

Limited to periods during which dispute risks continue

stores.

At the end of the period, data is deleted, destroyed or anonymized in accordance with the contract provisions and instructions made with your employer.

7. RIGHTS OF EMPLOYEES WITHIN THE SCOPE OF KVKK

In accordance with Article 11 of KVKK, as a personal data subject, regarding your personal data processed within the scope of the Platform

Learning whether your personal data is processed

Requesting information if your personal data has been processed

Learning the purpose of processing your personal data and whether they are used in accordance with their purpose

Knowing the third parties to whom your personal data is transferred

Requesting correction if your personal data is processed incompletely or incorrectly

Requesting deletion or destruction of your data within the framework of Article 7 of KVKK

Requesting notification of the transactions made to third parties to whom your data is transferred

Objecting to a result that emerges against you as a result of being analyzed only through automated systems

Requesting compensation for damage in case you suffer damage due to unlawful processing of data

you have rights.

When exercising these rights, it is essential that you primarily use the communication channels determined by your employer company as the data controller. In case of direct applications to Work24, your request is forwarded to the relevant Data Controller employer and finalized in coordination with your employer.

You can send your applications to our company through the methods specified under the "Application Methods" heading in the KVKK Disclosure Text (Company).

8. CHANGES THAT CAN BE MADE TO THE TEXT

Work24 reserves the right to make changes to this Text in accordance with the current legislation, Board decisions and updates in the Platform. The current Text enters into force when it is made available to employees through the Platform or other methods deemed appropriate.

DEMİRKANLI MAKİNA İNŞAAT SANAYİ VE TİCARET ANONİM ŞİRKETİ