This Privacy Notice explains the collection, processing and transfer of personal data and your rights under Turkish Personal Data Protection Law No. 6698 (“KVKK”). Grindballs Bilya Çelik Sanayi ve Ticaret Anonim Şirketi (“Grindballs” or the “Company”), located at Dilovası OSB Mahallesi, D-2029 Sokak No: 1/1, Dilovası / Kocaeli, acts as data controller and processes personal data as described below. Further information is available in the Personal Data Processing and Protection Policy.
1. Personal Data We Process
- Identity: name, surname, Turkish identity number, signature, tax number, place and date of birth, civil-register information, gender, marital status and information on identity or driving-licence copies.
- Contact and location: email, telephone and mobile numbers, social-media accounts, residence, address and location data.
- Professional experience: CVs, association or foundation memberships disclosed in them, applications, education and employment history, diplomas, courses, in-service training, certificates and transcripts.
- Personnel records: information and supporting documents required under labour legislation, including salary, social-security premiums, registration number, payroll, advances, working hours, annual and other leave, performance reports, professional qualifications, achievements, disciplinary statements, medical-leave status, allocated devices, education, emergency duties, title, department, manager, military status, professional registrations, employee transactions and vehicle plates.
- Legal, security and technical records: enforcement information, contracts, powers of attorney, entry/exit records, photographs, video and CCTV recordings, IP addresses, browsing on company networks and systems, passwords and access logs.
- Financial and marketing data: payment-card data, account and IBAN numbers, salary and bonus information, taxes and deductions, receivables, debts, maturity dates and cookie records.
- Special-category and incident data: criminal-record and security-measure information, blood group, medical-report details, disability, devices or prostheses, accident reports and incident records.
- Relationship data: family-member information; professions, education, hobbies and interests of customers or prospects; and personal data contained in product/service requests, complaints and similar applications.
2. Purposes of Processing
We process personal data only as necessary to manage emergencies and information security; fulfil employment and statutory obligations; administer employee benefits, audit and ethics, access rights and training; ensure legal compliance; perform finance and accounting; secure physical premises; arrange assignments and travel; conduct and defend legal matters; perform internal audit, investigations and security activities; communicate; operate and supervise business activities; manage occupational health and safety, business continuity and logistics; purchase and sell goods or services and provide after-sales support; manage events, marketing analysis, social-responsibility work, contracts, strategic planning, requests and complaints, supply chains and investments; report to authorised persons and public bodies; carry out management and customer-relationship processes; improve customer satisfaction; maintain visitor records; and evaluate candidates, internships, interviews and references.
3. Collection Methods
Personal data may be collected through automated or non-automated channels including email, SMS, business cards, telephone, fax, CCTV, physical forms, our website, post, cargo or courier services, face-to-face meetings and other physical or electronic environments.
4. Legal Grounds
Processing relies on the grounds in Articles 5 and 6 of KVKK, including where expressly required by law; necessary to establish or perform a contract; necessary to fulfil the Company’s legal obligations; necessary to establish, exercise or defend a right; necessary for legitimate interests without harming fundamental rights and freedoms; necessary to protect life or physical integrity where consent cannot be given; or based on explicit consent. Special-category data is processed where permitted by law, with explicit consent where required, and health or sexual-life data may be processed by persons under a duty of confidentiality for public health, preventive medicine, diagnosis, treatment, care, or the planning and management of health services and financing.
5. Transfer of Personal Data
Subject to Articles 8 and 9 of KVKK and for the purposes stated above, personal data may be transferred within Türkiye or abroad to business partners, suppliers, shareholders, authorised public bodies and institutions, legally authorised persons, Faydasıçok Holding group companies and natural persons or private-law legal entities where required for business operations.
6. Retention and Disposal
Data is retained for the period required by applicable legislation, for the purpose of processing, or for the period needed to establish, exercise or defend the Company’s rights in a possible dispute under Article 5/2(e) of KVKK. When those periods end and no legal ground remains, data is deleted, destroyed or anonymised without delay in accordance with KVKK, the Regulation on the Deletion, Destruction or Anonymisation of Personal Data and Company policies.
7. Your Rights
Under Article 11 of KVKK you may learn whether your personal data is processed; request information if it is; learn the processing purpose and whether data is used accordingly; learn recipients in Türkiye or abroad; request correction of incomplete or inaccurate data and notification to recipients; request deletion or destruction when processing grounds cease and notification to recipients; object to an adverse result arising exclusively from automated analysis; and request compensation for damage caused by unlawful processing.
Applications are generally free. If fulfilment creates an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
8. Statutory Exception
Where personal data must be processed for preventive, protective or intelligence activities carried out by legally authorised public bodies to protect national defence, national security, public security, public order or economic security—including epidemics, natural disasters or activities threatening national security—Article 28 of KVKK may apply. Grindballs will nevertheless observe fundamental principles and proportionality.
9. How to Apply
You may apply in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, together with identity-verifying documents: in person or through a notary at Dilovası OSB Mahallesi, D-2029 Sokak No: 1/1, Dilovası / Kocaeli, with the envelope marked “Information Request under the Personal Data Protection Law”; or through Registered Electronic Mail (KEP), signed with a secure electronic signature, to kvkk@faydasicok.com with the subject “Personal Data Protection Law Information Request”. Other methods adopted by the Board will be announced.
Related documents include the Data Subject Application, the Contact Privacy Notice and the CCTV Privacy Notice for our premises.