Skip to content
ER-EL

ER-EL Data Pool

Verify your e-mail address

We have sent a 6-digit code to your e-mail address.

Your data quota is used up

You have used up the number of data downloads allocated to you. Submit a request for an additional quota; your quota is increased once the administrator approves it.

ER-EL
HKDS Request Form Online Store
en Select language

Select language

Tip: if you enter the full product code, the product page opens directly. (e.g. 2330-127160)

Protection of Personal Data

Policy on the Processing and Protection of Personal Data

Download the document (Word) ↓

The Turkish version of this text is the authoritative one. In the event of any discrepancy between the translation and the Turkish text, the Turkish text shall prevail. View the Turkish text

POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA (Kişisel Verilerin İşlenmesi ve Korunması Politikası)

TABLE OF CONTENTS

Purpose

The principal purpose of this Policy on the Protection and Processing of Personal Data (“Policy”) is, by providing explanations concerning the personal data processing activity carried out lawfully by Er-El Makina Yedek Parça İml. San. ve Tic. Limited Şirketi (“Company”) and the systems adopted for the protection of personal data, to determine the procedures and principles to be complied with by the persons who process data by virtue of their relationship with the Company and to ensure transparency towards the persons whose data is processed.

The Company carries out its activities in accordance with the Turkish Personal Data Protection Law No. 6698 (“PDPL”) and the relevant legislation, and primarily with the Constitution of the Republic of Türkiye and the provisions of the international conventions to which we are a party, regarding the protection and confidentiality of personal data. The Company approaches the protection of personal data and of fundamental rights and freedoms with sensitivity; in all of its activities it keeps fundamental human rights such as the privacy of private life and freedom of thought at its focal point.

Scope and Application

This Policy has been prepared with due regard to the regulations in force and to international standards. The Company shall primarily apply this Policy in all data processing activities such as processing, transferring and altering data.

The Company also has different policies addressing the protection of personal data and the provision of information security in relation to certain business activities and processes. Unless it contains additional conditions or requires a higher standard for the protection of personal data, this Policy does not invalidate the data protection conditions in the Company’s said different policies. This Policy is applied, to the extent appropriate, together with the said other policies and procedures.

In the event of a conflict between the provisions of the relevant legislation in force on the protection and processing of personal data and the provisions of this Policy, the provisions of the current legislation shall prevail.

Definitions

PDPL: Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu)

GDPR: European Union General Data Protection Regulation

Data Processor: The natural and legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller

Data Controller: The person who determines the purposes and means of processing personal data and who manages the place where the data is kept systematically (data recording system)

Data Owner/Data Subject: The employees, customers, business partners, shareholders, officers, potential customers, candidate employees, interns, visitors and suppliers with whom the Company and the Company’s affiliated subsidiaries have a commercial relationship, the employees of the institutions with which it works in cooperation, third parties and, without being limited to those listed herein, the natural persons whose personal data is processed

Explicit Consent: Consent relating to a specific subject, based on information and declared with free will

Personal Data: Any information relating to an identified or identifiable natural person

Special Categories of Personal Data: data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, together with their biometric and genetic data

Processing of Personal Data: Any operation carried out on data, such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making obtainable, classifying or preventing the use of personal data by wholly or partly automated means or by non-automated means provided that it forms part of any data recording system

Rendering Personal Data Anonymous: Rendering personal data incapable of being associated in any way whatsoever with an identified or identifiable natural person, even by matching it with other data

Erasure of Personal Data: Rendering personal data in no way accessible and no longer reusable for the relevant users

Destruction of Personal Data: The operation of rendering personal data in no way accessible, retrievable and reusable by anyone

PDP Board/the Board: The Personal Data Protection Board

PDP Authority/the Authority: The Personal Data Protection Authority

Processing of Personal Data

Principles Observed in the Processing of Personal Data

The Company’s policies and procedures are applied in parallel with the processing principles set out in the PDPL and the relevant legislation. We know that these principles are of vital importance for data subjects’ exercise of their rights and for their control over their data, and we show the utmost sensitivity in making these principles our focal point in all of our processing activities. Our principles in our personal data processing activities are as follows;

  • Personal data is processed lawfully, fairly and transparently.

    The Company relies on the legal processing grounds set out in the PDPL in its data processing activities. Furthermore, as required by the principle of fairness, it observes the reasonable expectations of data subjects. The Company uses clear and comprehensible language in its communication with the data subject and is always in an easily accessible position.

  • Personal data is processed only for specific, explicit and legitimate purposes.

    The Company determines the purpose of the processing activity before carrying out data processing activities. Data is processed only for additional purposes that are compatible with the initial purpose of processing. For each additional purpose, compatibility with the initial purpose is determined according to internationally accepted criteria. Our Company informs data subjects about the purposes of data processing with due regard to the principle of transparency.

  • Personal data is relevant, limited and proportionate to the purposes for which it is processed.

    Our Company processes the amount of data that is necessary for the purpose of processing. Data is obtained by the method that is most appropriate in terms of data confidentiality and security. In our processing activities, disproportionate interference with the rights, interests and freedoms of data subjects is avoided.

  • Personal data is accurate and, where necessary, up to date.

    The Company ensures that data is up to date in all of its processing activities. Incomplete, erroneous or incorrect data is destroyed or corrected as soon as possible. The Company checks the currency of the data at regular intervals.

  • Personal data is retained for the period stipulated in the relevant legislation or required for the purpose for which it is processed.

    Upon the disappearance of the purposes of data processing, the data is erased, destroyed or rendered anonymous as soon as possible.

  • Personal data is processed in a manner directed at ensuring appropriate security.

    Our Company applies data security as a main principle. It takes the necessary administrative and technical measures by following best practices in this direction.

  • The Company demonstrates that it ensures compliance with the other principles of the PDPL and/or the GDPR.

    Our Company observes the principle of accountability in all of its processing activities.

The Company’s Purposes of Processing Personal Data

The purposes of processing the personal data processed by the Company are as follows:

  • Carrying Out Employee Candidate / Intern / Student Selection and Placement Processes
  • Carrying Out the Application Processes of Employee Candidates
  • Carrying Out Employee Satisfaction and Commitment Processes
  • Fulfilment of Obligations Arising from the Employment Contract and from the Legislation for Employees
  • Carrying Out Fringe Benefits and Interests Processes for Employees
  • Carrying Out Audit / Ethics Activities
  • Carrying Out Activities in Compliance with the Legislation
  • Carrying Out Training Activities
  • Carrying Out Finance and Accounting Affairs
  • Ensuring the Security of Physical Premises
  • Carrying Out Assignment Processes
  • Follow-up and Carrying Out of Legal Affairs
  • Carrying Out Internal Audit / Investigation / Intelligence Activities
  • Carrying Out Communication Activities
  • Planning of Human Resources Processes
  • Carrying Out / Auditing Business Activities
  • Receiving and Assessing Suggestions for the Improvement of Business Processes
  • Carrying Out Activities for Ensuring Business Continuity
  • Carrying Out Occupational Health / Safety Activities
  • Carrying Out Goods / Services Sales Processes
  • Carrying Out After-Sales Support Services for Goods / Services
  • Carrying Out Goods/Services Procurement Processes
  • Carrying Out Goods / Services Production and Operation Processes
  • Carrying Out Marketing Processes for Products / Services
  • Carrying Out Marketing Analysis Studies
  • Carrying Out Customer Relationship Management Processes
  • Carrying Out Activities Directed at Customer Satisfaction
  • Carrying Out Risk Management Processes
  • Organisation and Event Management
  • Carrying Out Storage and Archiving Activities
  • Carrying Out Contract Processes
  • Carrying Out Access Authorisations
  • Carrying Out the Wage Policy
  • Ensuring the Security of Data Controller Operations
  • Follow-up of Requests / Complaints, Carrying Out Communication Processes
  • Providing Information to Authorised Persons, Institutions and Organisations

The Company’s Legal Grounds for Processing Personal Data:

When processing personal data, the Company relies on one of the legal processing conditions set out in Article 5 of the PDPL. The conditions for the processing of personal data, that is, the situations of lawfulness, are listed in a limited number in the Law and these conditions cannot be extended. When processing personal data, the Company relies on the following legal grounds:

  • The existence of the data subject’s explicit consent,
  • It being expressly stipulated in the laws,
  • It being necessary to process the personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of that contract,
  • It being mandatory for the data controller to be able to fulfil its legal obligation,
  • It being mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Our Company does not rely on the legal ground of explicit consent where another legal ground exists.

Legal Grounds for the Processing of Special Categories of Personal Data

Special categories of personal data are data such as a person’s religion, race, belief, health and sexual life which, if disclosed, would expose the person to discrimination. Special categories of personal data cannot be processed without the existence of the limited legal grounds listed in Article 6 of the PDPL.

In this context, the Company processes special categories of personal data other than health or sexual life;

  • on the basis of the legal grounds of the data subject’s explicit consent. Data relating to health and sexual life, on the other hand;
  • the data subject’s explicit consent,
  • it processes on the basis of the legal grounds of the existence of the purposes of protection of public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing, by persons under the obligation of confidentiality.

Duty to Inform

The Company is obliged to inform data subjects pursuant to the PDPL and to the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Duty to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). If personal data is obtained from the data subject, the Company informs the data subjects at the moment the data is obtained, either itself or through the persons it has authorised. If the personal data is not obtained from the data subject, the duty to inform is fulfilled within a reasonable period; if the data is to be used for the purpose of communicating with the data subject, at the moment of the first communication; and if the data is to be transferred, at the latest at the time the first transfer is to be made.

The Company informs data subjects, as a minimum, about the Company’s legal entity and address information, for what purpose the personal data will be processed, to whom and for what purposes the processed data may be transferred, the method of collecting personal data and the legal ground therefor, and the rights listed in Article 11 of the PDPL.

When the purpose of processing personal data changes, the duty to inform is fulfilled separately for that purpose before the data processing activity.

Data Security

As the data controller in the processing of personal data, we, the Company, are obliged to prevent the unlawful processing of and access to personal data and to ensure its preservation. For this reason, the Company has taken all technical and administrative measures relating to data security, including the additional measures required for the protection of special categories of personal data. The measures taken by our Company in this context are listed below.

Technical Measures

  • Access to the administration panel is role-based; each module is opened with a separate permission and is not visible at all to unauthorised users.
  • Administrator and member passwords are stored as hashes; passwords are never kept as plain text anywhere.
  • Failed login attempts are counted per IP address and per account; at defined thresholds a graduated temporary access lock is applied.
  • The number of requests is limited on the form submission, file upload, login, verification code and data download endpoints.
  • The session cookie is encrypted and cannot be read by browser scripts; an anti-forgery (CSRF) token is verified on every form submission.
  • Database queries run with bound parameters; no value received from a user is placed directly into a query.
  • In form records the visitor’s IP address is not stored in raw form but as a one-way hash.
  • The technical data files provided to members are kept outside the web root directory, in a separate area, and are delivered only to approved members with a record kept.
  • Consent records under the Personal Data Protection Law are stored in a separate table together with the full text shown at the time of consent, its language and the time.
  • An automatic destruction date is assigned to contact records; records whose period has expired are deleted.
  • Operations in the administration panel such as data downloads and password setting are logged.

Administrative Measures

  • A personal data processing inventory is prepared; it is updated whenever processing activities change and is notified to the Data Controllers’ Registry (VERBİS).
  • The Policy on the Processing and Protection of Personal Data and the Retention and Destruction Policy are prepared, kept up to date and made accessible to data subjects.
  • The duty to inform is fulfilled at the moment the personal data is obtained from the data subject; where the data is obtained from another source, it is fulfilled at the latest at the time of the first communication or the first transfer.
  • Employees’ access rights to personal data are limited by their job descriptions; these rights are reviewed upon recruitment, change of duty and termination of employment.
  • A confidentiality undertaking is signed with employees who process personal data; the undertaking forms an integral part of the employment contract.
  • Employees receive awareness training on the protection of personal data, and this training is repeated at regular intervals.
  • Written contracts containing provisions on the protection of personal data are concluded with suppliers and service providers that process personal data on behalf of the Company; regular checks are carried out on these parties.
  • The response steps to be followed in the event of a personal data breach have been established. A breach is notified to the Personal Data Protection Board as soon as possible and within 72 hours at the latest from becoming aware of it, and to the data subject as soon as possible.
  • The security of documents and physical media containing personal data is ensured; access to such media is limited to authorised personnel.
  • Data subject applications are recorded and answered within 30 days at the latest.
  • The sanctions to be applied in the event of conduct contrary to this Policy are determined and the disciplinary process is carried out.
  • The technical and administrative measures taken and the data processing activities are audited at regular intervals; any deficiencies identified are remedied.

Transfer of Personal Data

Domestic Transfer

Our Company transfers personal data to third parties on the basis of the data processing conditions set out in Articles 5 And 6 of the PDPL. The Company takes all necessary security measures in its data transfer activities.

Transfer Abroad

Pursuant to Article 9 of the PDPL, the Company transfers data abroad by satisfying one of the following conditions.

  • The existence of the data subject’s explicit consent,
  • The country to which the personal data is to be transferred having the status of a “safe country” and providing adequate protection,
  • Adequate protection being undertaken in writing by regulating the rights and obligations of the Company and of the receiving party in relation to the data transfer, and the permission of the Board being obtained.

Personal Data Inventory

The Company has created a data inventory, with the details stipulated by the Law, in respect of the personal data processed within the scope of the PDPL. The Company’s data inventory contains the following details:

  • The business processes in which the personal data is used,
  • The category of the personal data,
  • The personal data processed,
  • The special categories of personal data processed,
  • The purpose and legal ground of the processing activity,
  • The domestic recipients of the personal data,
  • Whether or not the personal data is transferred abroad,
  • The retention periods of the personal data

In the event of a change in the Company’s processing activities, the Personal Data Inventory (Kişisel Veri Envanteri) is updated. The Company notifies the information contained in the Personal Data Inventory, and any updates thereto, to the Data Controllers’ Registry (Veri Sorumluları Kayıt Sicili). The information that the Company will provide to the data subject within the framework of the duty to inform referred to in Article 5 of this Policy is consistent with the information disclosed to the Registry.

Roles and Responsibilities

The roles and responsibilities of our Company relating to the processing of personal data are as follows:

  • Human Resources The relevant unit is responsible for notifying this Policy to data subjects such as customers, subcontractors and suppliers whose data is processed.
  • Human Resources The relevant unit is responsible for informing the parties that process data on behalf of the Company, such as employees and suppliers, about this Policy, and, through regular checks, for the application of the Policy by the said data processors.
  • Information Technologies The relevant unit is responsible for updating this Policy. The unit makes the necessary improvements with due regard to the needs of the Company’s information technology systems and, where necessary, carries out the process of updating the Policy.
  • General Management The relevant unit is authorised to approve the updates relating to this Policy.
  • Human Resources The relevant unit is responsible for determining and applying the sanctions in the event of violations relating to the application of the Policy.

Erasure, Destruction and Anonymisation of Personal Data

  • Pursuant to Article 7 of the PDPL and the provisions of the other relevant legislation, in the event that the grounds for processing personal data cease to exist, the personal data is erased, destroyed or rendered anonymous upon the decision of the Company, its periodic check and/or the request of the data subject.
  • The Company shall not retain personal data for longer than necessary in connection with the reason for which the personal data was obtained. Upon the disappearance of the processing grounds, the Company erases, destroys or renders anonymous the personal data in the first periodic destruction operation following the date on which the obligation to erase, destroy or render anonymous the personal data arises.
  • The Company has prepared a Retention and Destruction Policy (Saklama ve İmha Politikası) in order to determine the procedures and principles in this direction. The retention period for each category of personal data, and the criteria used for the retention and destruction periods, including the legal obligations under which the Company is obliged to retain the data, are set out in this Retention and Destruction Policy. This Retention and Destruction Policy has been drawn up in accordance with the Personal Data Inventory referred to in Article 8 of this Policy.
  • In the erasure, destruction or rendering anonymous of personal data, the Company acts in accordance with the principles set out in part 4/a of this Policy, the technical and administrative measures set out in Article 6 thereof, the Retention and Destruction Policy, the provisions of the relevant legislation and the decisions of the Board.
  • Personal data shall be destroyed securely and by the most appropriate method, in line with the provisions of the PDPL, the relevant legislation and the Company’s Retention and Destruction Policy. Upon the request of the data subject, the Company selects the appropriate method by explaining its reasoning.

The Data Subject’s Rights and the Exercise of His/Her Rights

Rights of the Data Subject

Pursuant to Article 11 of the PDPL, data subjects have the following rights in relation to their processed personal data:

  • To learn whether or not their personal data is being processed,
  • If their personal data has been processed, to request information regarding the nature of this information and to learn to whom it has been disclosed,
  • To learn the purpose of the processing of the personal data and whether it is used in accordance with its purpose,
  • To know the third parties to whom the personal data is transferred domestically or abroad and to request that the transaction carried out in this respect be notified to third parties,
  • In the event that the personal data has been processed incompletely or inaccurately, to request its correction and to request that this be notified to third parties,
  • To request the erasure or destruction of the personal data in the event that the grounds requiring its processing cease to exist, notwithstanding that it has been processed in accordance with the provisions of the relevant law,
  • To object to the arising of a result to the detriment of the person himself/herself,
  • To claim compensation for the damage in the event of suffering damage owing to the unlawful processing of the personal data.

Exercise of Rights

Applications and requests relating to personal data, via Human Resources,

  • by sending them, together with your wet signature and a photocopy of your identity document, to the address Çerkeşli OSB Mah. İmes 3 Blv. No:1 Dilovası/Kocaeli, or,
  • by signing them with a secure electronic signature or mobile signature and sending them to the e-mail address ik@er-el.com.tr, or,
  • by signing them with a secure electronic signature or mobile signature and sending them, by means of registered electronic mail (KEP), to the address er-elmakina@hs01.kep.tr, or,
  • by applying in person to Er-El Makina Yedek Parça İml. San. ve Tic. Limited Şirketi with a valid identity document

may be conveyed.

Within the scope of the legal requirements concerning the procedures and principles of application to the data controller, data subjects must include in their application their name, surname, their signature if the application is in writing, their Turkish Republic identity number if they are a citizen of the Republic of Türkiye, their nationality if they are a foreigner, their passport (or identity, if any) number, their place of residence or business address for the purposes of notification, their e-mail address and fax number, if any, for us to take as the basis for notification, and finally the subject of the request. In addition, documents verifying identity, together with information and documents relating to the subject of the request, must be attached to the application.

In order for the process to be conducted in the most effective manner, which right is intended to be exercised in the subject of the request and the details relating to the requested action must be stated clearly and comprehensibly.

The subject of the request must relate to the data subject himself/herself. If the application is made on behalf of another person, the person making the request must rely on an authority specifically documented for the requested action (power of attorney). Applications made without authority shall not be taken into assessment.

Assessment of the Application

  • Applications are assessed and, as soon as possible and at the latest as from the date on which the application reaches us,
  • a response is provided within 30 days.
  • During the assessment process, additional information and documents may be requested if necessary, and in the cases appropriate under the relevant legislation a fee may be requested for the fulfilment of the request.
  • The Company takes all necessary administrative and technical measures in order to conclude the applications to be made by the data subject effectively and in accordance with the law and the principle of fairness.

Rejection of the Application

  • The application;
    • where the application is not made in accordance with the procedure set out above,
    • where the application contains a request contrary to the legislation in force,
    • where the application is not based on a justified reason or is in the nature of an abuse of right,
    • the processing of the personal data that is the subject of the application for purposes such as research, planning and statistics by rendering it anonymous with official statistics,
    • the processing of personal data made public by the data subject himself/herself.
    • is rejected in the event of the existence of one of the other situations falling within the scope of Article 28 of the PDPL. In the event that the application is rejected, the Company notifies the data subject of the rejection response by explaining its reasoning.

Right to Complain

  • In the applications made to the Company, the data subject has the right to complain to the Board where his/her application is rejected, or where he/she finds the response given by the Company insufficient, or where no response is given by the Company within 30 days.

The data subject may exercise the right to complain within 30 days from the date on which he/she learns of the Company’s response and in any event within 60 days from the date of the application.

Publication of the Policy and Entry into Force

This Policy enters into force on 14.08.2026.

The current version of this Policy is published on 14.08.2026.

Updating of the Policy

This Policy is updated for a period of 1 year.

The repealed old copies of this Policy are cancelled with the approval of human resources and retained by human resources for 1 year. Policies whose retention period has expired are destroyed by human resources by drawing up a minute.

2026 TRADE FAIR CALENDAR
CLICK FOR TICKETS

Cookie preferences

Cookie Policy