1. INTRODUCTION

The protection of personal data is among our core values at Mukan Consulting Ltd. Co. ("Our Company"). Our company takes all necessary actions to ensure that all personal data processed within the scope of our business activities are processed in compliance with the legislation. This document explains the principles adopted by our company in carrying out personal data processing activities and detailed information regarding compliance with the Personal Data Protection Law No. 6698 ("KVKK"). Thus, our company provides the necessary transparency by informing personal data owners.

2. SCOPE

This General Information Document applies to all data subjects whose personal data are processed by our company. However, the information regarding the personal data of our company employees is not evaluated within this document. The table showing the mentioned data subjects is provided below.

CATEGORY OF PERSONAL DATA OWNER	EXPLANATION
Employee / Intern Candidate:	Refers to real persons who have applied for a job or made their CV information available for our company's review.
Business Partner Employee / Official / Shareholder:	Refers to real persons who are shareholders, officials, or employees of companies with which our company has established a business partnership for purposes such as sales, promotion, and marketing of products and services, after-sales support, and joint customer loyalty programs.
Customer:	Refers to real persons who use, have used, or apply to use the products and services offered by our company, or real persons who are employees, officials, or shareholders of real or legal persons.
Supplier Employee / Official / Shareholder:	Refers to real persons who are shareholders, officials, or employees of companies providing goods and/or services to our company based on an existing and/or future contract.
Visitor:	Refers to real persons who visit our company's premises and online platforms or join our company's guest internet network.

3. CONDITIONS FOR PROCESSING PERSONAL DATA

In accordance with the KVKK, the processing of personal data is considered lawful under certain conditions. The first of these is obtaining the explicit consent of the personal data owner. In the presence of one of the conditions listed below, personal data is processed by our company without seeking the explicit consent of the data owner.

Apart from explicit consent, the basis for personal data processing activity can be only one of the conditions stated below, or multiple conditions can be the basis for the same personal data processing activity.

3.1. Explicitly Stipulated in Laws

If explicitly stipulated in the law, in other words, if there is an explicit provision in the relevant law regarding the processing of personal data, the personal data of the data owner may be processed by our company within the framework stipulated by the legislation.

3.2. Failure to Obtain Explicit Consent Due to Actual Impossibility

If it is mandatory to process the personal data of a person who is unable to express their consent due to an actual impossibility or whose consent cannot be deemed valid, in order to protect the life or physical integrity of themselves or another person, the personal data of the data owner may be processed.

3.3. Direct Relevance to the Establishment or Performance of a Contract

Provided that it is directly related to the establishment or performance of a contract to which the data owner is a party, this condition may be deemed fulfilled if processing personal data is necessary.

3.4. Fulfillment of Our Company's Legal Obligation

If data processing is mandatory for our company to fulfill its legal obligations, the personal data of the data owner may be processed.

3.5. Publicization of Personal Data by the Personal Data Owner

If the data owner has made their personal data public, the relevant personal data may be processed limited to the purpose of publicization.

3.6. Necessity of Data Processing for the Establishment, Exercise, or Protection of a Right

If data processing is mandatory for the establishment, exercise, or protection of a right, the personal data of the data owner may be processed.

3.7. Necessity of Data Processing for the Legitimate Interest of Our Company

Provided that it does not harm the fundamental rights and freedoms of the personal data owner, if data processing is mandatory for the legitimate interests of our company, the personal data of the data owner may be processed.

4. Processing of Special Categories of Personal Data

Special importance is attributed to sensitive personal data under the Law. The "special categories" of personal data defined by the KVKK are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, association, foundation or union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

(i) Special categories of personal data other than health and sexual life may be processed without seeking the explicit consent of the data owner if explicitly stipulated in the laws, in other words, if there is an explicit provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained.

(ii) Special categories of personal data relating to health and sexual life may be processed without seeking explicit consent by persons subject to an obligation of confidentiality or authorized public institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and financing. Otherwise, the explicit consent of the data owner will be obtained.

5. Processing of Personal Data in Accordance with the Principles Stipulated in the Legislation

5.1. Processing in Accordance with the Law and Principles of Honesty

Personal data is processed in accordance with the general trust and honesty principles in a way that does not harm the fundamental rights and freedoms of individuals. In this context, personal data is processed to the extent required by our company's business activities and limited to them.

5.2. Ensuring Personal Data is Accurate and Up-to-Date When Necessary

Our company takes the necessary measures to ensure that personal data is accurate and up-to-date throughout the processing period and establishes the necessary mechanisms to ensure the accuracy and currency of personal data at certain intervals.

5.3. Processing for Specific, Explicit, and Legitimate Purposes

Our company clearly defines the purposes of processing personal data and processes them within the scope of purposes connected to these activities in line with its business activities.

5.4. Being Relevant, Limited, and Proportionate to the Purpose for Which They Are Processed

Our company collects personal data only in the quality and extent required by its business activities and processes them limited to the designated purposes.

5.5. Retaining for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which They Are Processed

Our company retains personal data for the minimum period stipulated in the relevant legal legislation and the time necessary for the purpose for which they are processed. In this context, our company first determines whether a period is stipulated for the storage of personal data in the relevant legislation, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is retained for the period necessary for the purpose for which they are processed. Personal data is destroyed at the end of the determined retention periods in accordance with periodic destruction periods or the application of the data owner and by determined destruction methods (deletion and/or destruction and/or anonymization).

6. Categories of Processed Personal Data and Purposes of Processing

Within the scope of fulfilling the business activities carried out by our company, the purposes of processing personal data and special categories of personal data processed in accordance with the provisions of the Law and relevant legislation are listed below:

1. Presenting our company's services to relevant parties and conducting related processes,
2. Conducting human resources policies for our company's recruitment processes,
3. Establishing and conducting business relations with business partners such as suppliers and subcontractors,
4. Carrying out our company's finance and accounting activities,
5. Carrying out activities regarding our company's legal relations and fulfilling our company's legal obligations.

7. Transfer of Personal Data

Our company may transfer personal data and special categories of personal data to third parties by taking the necessary security measures in line with the regulations stipulated in Articles 8 and 9 of the Law and the principles and procedures stipulated in secondary legislation.

Personal data may be transferred to third parties by our company without the need for the explicit consent of the data owners in the following cases, in line with the principles and procedures stipulated in the Law and secondary legislation:

1. Explicitly stipulated in the laws regarding the relevant activities for the transfer of personal data,
2. The transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
3. The transfer of personal data is mandatory for our company to fulfill its legal obligation,
4. Transfer by our company limited to the purpose of publicization, provided that the personal data has been made public by the data owner,
5. The transfer of personal data by the Company is mandatory for the establishment, exercise, or protection of the rights of the Company, the data owner, or third parties,
6. It is mandatory to engage in personal data transfer activity for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner,
7. It is mandatory to protect the life or physical integrity of the person or someone else who is unable to explain their consent due to actual impossibility or whose consent is not legally valid.

If personal data is to be transferred abroad, in addition to the conditions listed above, it is transferred to foreign countries declared by the Board to have adequate protection, or in the absence of adequate protection, to foreign countries where the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing and the Board's permission is present.

The table showing the parties to whom personal data is transferred by our company and the transfer purposes is below.

TRANSFERRED PARTY	TRANSFER PURPOSE
Suppliers	Our company shares the necessary personal data strictly limited to the provision of such services with suppliers from whom it receives services on certain issues within the scope of conducting business activities.
Legally Authorized Public Institutions and Private Organizations	Personal data is shared with public institutions and organizations authorized to receive information and documents from our company according to the provisions of the relevant legislation. Personal data is shared with independent auditors working to carry out audits required by our legal obligations.

8. Fulfillment of the Obligation to Inform

In accordance with the Communiqué on the Procedures and Principles to be Complied with in Fulfilling the Obligation to Inform, our company fulfills the obligation to inform set forth in Article 10 of the Law by informing personal data owners about by whom their personal data is processed as the data controller, for what purposes, with whom it is shared for what purposes, by what methods it is collected and its legal basis, and the rights the data owners have within the scope of processing their personal data.

9. Retention and Destruction of Personal Data

Our company retains personal data for the minimum period stipulated in the relevant legal legislation and the time necessary for the purpose for which they are processed. In this context, our company first determines whether a period is stipulated for the storage of personal data in the relevant legislation, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is retained for the period necessary for the purpose for which they are processed. Personal data is destroyed at the end of the determined retention periods in accordance with periodic destruction periods or the application of the data owner and by determined destruction methods (deletion and/or destruction and/or anonymization).

10. Personal Data Security

Our company fulfills the obligation stipulated in Article 12 of the Law to take necessary measures according to the nature of personal data to prevent unlawful disclosure, access, transfer, or other security deficiencies that may occur in personal data. In this context, it takes administrative measures to provide the necessary security level, gives training to employees on this issue, and conducts or has audits conducted.

11. Contact

For all your questions regarding the Personal Data Protection Law Information, you can reach our company by mail at Çayhane Sokak No : 47 / 1 Gop / Ankara, by e-mail at mukan@mukangroup.com, and by calling 0 312 473 11 55.