HYSSA FİNANSAL TEKNOLOJİ A.Ş. WEBSITE PERSONAL DATA PROCESSING AND PROTECTION POLICY

HYSSA FİNANSAL TEKNOLOJİ A.Ş. (hereinafter referred to as the "Company") takes all kinds of technical and administrative measures in accordance with the Personal Data Protection Law No. 6698 ("Law") in the processing of your personal data due to its activities.

Your personal information is processed by our company, as the name of the data controller;

In accordance with the law and the rule of fairness,
Within the framework of the service/goods contract between us and our supplier, consultant, citizen and other employee candidates,
By keeping its up-to-date and correctness as you have notified or reported to us,
In accordance with the purpose of processing, in a limited and measured way,
By keeping it for as long as required by the relevant legislation or for the purpose for which it is processed.

As Hyssa, we inform you that we process your personal data as a data controller within the scope of the Personal Data Protection Law No. 6698 and other relevant legislation.

a) Personal Data Processed, Its Categories and Our Reasons for Processing Data Based on Data Category

In accordance with the Law and other relevant legislation, the personal data categories and explanations to be processed within the scope of the purposes and legal reasons specified in this Text are as follows:

Provided that the data subject has given his explicit consent (“art. 5/1, art. 6”).
If expressly stipulated in the laws (“art.5/2-a”)
In case of an actual impossibility (“art.5/2-b”).
Provided that it is directly related to the establishment or performance of a contract if it is necessary to process the personal data of the parties to the contract (“art.5/2-c”).
If it is mandatory for the data controller to fulfil its legal obligation (“art. 5/2-ç”).
If the data subject has made his personal data public by himself (“art.5/2-d”).
If it is mandatory for the establishment, exercise or protection of a right (“m.5/2-e”),
Provided that it does not harm the fundamental rights and freedoms of the person concerned, if it is mandatory for the legitimate interests of the data controller (“m.5/2-f”),
Existence of the situation stipulated in the laws (“art. 6/3”).

Data Processing Purpose	Processed Personal Data	Legal Bases to Process Personal Data	Methods to Gather Personal Data
Execution of the Recruitment Process	CV Name surname Marital Status Nationality Place of birth Date of birth Home phone mobile phone Email Military Status Place of Military Service Date of Military Service Graduated School-Place Graduated Department Graduation Year Graduation Degree Foreign Language Knowledge Seminars and Courses attended Work Experience	art. 5/1 art. 5/2-c art. 5/2-d art. 5/2-f	By e-mail by the Data Subject (Partially automated and non-automated)
Execution of the Job Entry Process	CV Name surname Marital status nationality Place of birth Province of Registered Population Date of birth Home phone Mobile phone Office phone E-mail Family Close Information Graduated School-Place Graduated Department Graduation Year Graduation Degree Foreign Language Knowledge Seminars and Courses Attended Work Experience (Company Name, Position, Remuneration, Entry-Exit Date, Reason for Leaving) Judicial Status	art. 5/1 art. 5/2-a art. 5/2-c art. 5/2-ç	By the Data Subject Physically and via E-mail (Partially automated and non-automated means)
Personnel Salary Payment Transactions	Name surname IBAN ID No Salary Information	art 5/2-c art. 5/2-ç art. 5/2-e	From the personnel file and by the data subject (Partially automated and non-automated means)
Wage Payments, Payroll (Financial payments, SGK Payments, Compensation, Execution AGI, BES Premium, Overtime payment processes)	Name and surname Salary payments Annual Leave Records Advance, Execution Five, Agi, Sgk, Tax Payments Severance, Notice, Compensation, Exit Payments	art. 5/2-c art. 5/2-ç art. 5/2-e	From the personnel file and by the data subject (Partially automated and non-automated means)
Execution of BES Transactions	ID No Name-surname The name of the father Data of Birth Phone number E-mail	art. 5/2-c art. 5/2-ç art. 5/2-e	From the personnel file and by the data subject (Partially automatic and non-automatic means)
Organization of Meetings	Name-surname ID No Birth of date	art. 5/2-c art. 5/2-e art.6	By the data subject (Partially automated and non-automated means)
Execution of Mail Order	The file of Mail Order Copy of credit card Copy of ID Name-surname ID No Birth of place & date Religion (from the old ID) The names of father and mother Address E-mail	art. 5/2-c art. 6	By the data subject (fully automated means)
Execution of Invoice Transactions (E-Invoice and E-Archive and Invoice)	Name-surname ID No Account number information Invoice detail E-mail Phone number Address	art. 5/2-c art. 6	By the data subject (fully automated means)
Processing of Expense Forms	Name surname Signature Title Cost Amount	art. 5/2-ç art. 5/2-e	By the data subject (non-automated means)
Collection Receipt Recording (Passed to Customer)	Collection Receipt-SLIP Name surname Signature	art. 5/2-ç	By the data subject (non-automated means)
Contract Tracking	Contracts Name and surname ID No Signature Bank Account No- Iban No Phone number Email	art. 5/2-c art. 5/2-ç	By the data subject (non-automated means)
E-Reconciliation Transactions	Name and surname ID No Phone number Email Address Debt information	art. 5/2-c art. 5/2-e	By the data subject (Partially automatic and non-automatic means)
Creating a Customer Current Card	Current Cards Name surname Phone number Email ID No Account No-Iban No Address	art. 5/2-e	By the data subject (fully automated means)
Guarantee Process -Power of Attorney	Name-surname Signature Signature Circular Copy of identity card nationality ID No. Photograph Biometric Photo Gender Parent Name Place of birth Date of birth Blood group (from the old ID) Marital status(from the old ID) Religion (from the old ID) Population Registration Information	art. 5/2-a art. 5/2-c art. 5/2-e art. 6	Institutional Resources (Partially automated and non-automated means)
Website Contact Form	Name Email Message		By the data subject (Partially automated and non-automated means)

b) Transfer of Personal Data to Domestic Third Parties

Data Transfer Purpose	Transferred Recipient Groups
In order to fulfill legal obligations and ensure the establishment of rights	Authorized public institutions and organizations
Execution of litigation, mediation and enforcement processes	Judicial and Administrative Authorities, Lawyers
Carrying out accounting processes	Financial advisor
Getting technical support	Supplier Sub-Agents
Conducting Business Activities	Related Supplier Company
Creating a Customer Current Card	Related Supplier Company
Execution of payment processes	Related Bank
Execution of the loan process	Related Bank
Guarantee Process - Execution of Power of Attorney transactions	Judicial Authorities and Lawyers
Execution of BES Processes	Related Company
E-Archiving	Related Supplier Company
Execution of Organizational Planning	Related Supplier Companies

c) Transfer of Personal Data to Third Parties Abroad

Data Transfer Purpose	Transferred Recipient Groups
Execution of mail orders	Relevant Customer Country
Realization of Collection Processes	Relevant Customer Country
Storing personal data	Relevant Customer Country
Execution of payment processes	Relevant Customer Country

d) Rights of the Data Subject

Data subjects, under the Law, have the following rights. By contacting us, data subjects can request the execution of any of them.

· Learning whether personal data is processed or not,

· If personal data has been processed, requesting information about it,

· Learning the purpose of processing personal data and whether they are used in accordance with its purpose,

· Knowing the third parties to whom personal data is transferred at home or abroad,

· Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,

· Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist despite the fact that it has been processed in accordance with the provisions of the law and other relevant laws, and requesting that the transaction carried out within this scope be notified to the third parties to whom the personal data has been transferred,

· Objecting to the emergence of a result against the person himself by analysing the processed data exclusively through automated systems,

· Requesting compensation of the damage in case of loss due to unlawful processing of personal data.

You can submit your requests regarding your rights to the Data Controller in accordance with the Communiqué on Application Procedures and Principles. You can also submit your requests by filling in the Data Subject request form on our website and sending it to us. Your requests will be evaluated and decided free of charge as soon as possible and within thirty (30) days at the latest. If the evaluation and decision-making process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be taken as a basis.

e) Data Controller Information

MERSIS No : 0465130694700001

Website address : https://hyssa.com

E-mail : info@hyssa.com

Address : Merkez Mah. Hasat Sk. Kamara Blok No: 52 İç Kapı No: 1 Şişli / İstanbul