SÜREKO PERSONAL DATA PROTECTION POLICY & NOTICE PROCEDURE
This policy aims to inform about Süreko Waste Management Transport Logistics Electricity Generation Inc.’s practices regarding personal data for which it is responsible—including plants and factories located in other provinces. It applies to all personal data obtained and processed as detailed below. Süreko may update the content and scope of this notice as needed.
METHOD AND LEGAL GROUNDS FOR COLLECTING PERSONAL DATA
Due to its commercial activities in cement and ready‑mix concrete production and sales, and in waste disposal and management, Süreko may need personal data of individuals with whom it engages. Examples of such data subjects include:
- Natural‑person customers
- Natural‑person suppliers
- Natural‑person dealers
- Natural‑person consultants (e.g., lawyers, accountants)
- Employees and shareholders of all business partners, including but not limited to customers, suppliers, business partners, dealers, consultants—and of group companies, affiliates, and subsidiaries
- Persons designated as guarantors, if any
- Job applicants
- Visitors to workplaces and facilities
The most frequently needed personal data among the above, required for Süreko’s operations, include:
- Identity information (e.g., name, surname, Turkish ID number, copies of ID card or driver’s license)
- Contact information (e.g., business address, business phone numbers and email addresses)
- Professional information (e.g., where required, master/foreman qualifications, certificates, job title)
- Commercial information (e.g., transactions within business relationships, commercial activities)
- Financial information (e.g., tax office, tax ID number, invoice details, credit card details, debt information, creditworthiness)
- Visitor logs and security camera footage
These data are usually provided directly and voluntarily by the data subjects to Süreko via printed documents such as evaluation, information and registration forms; order and payment instruction forms; annexes to contracts (e.g., tax certificate, signature circulars, ID copies) using non‑automated means, or by automated or partially automated means such as email and web‑based portals used by Süreko—always lawfully, for clear, specific, and legitimate purposes, to the extent permitted by applicable law, and with explicit consent where necessary.
Personal data may also be obtained when explicitly prescribed by law, when directly necessary for the establishment or performance of a contract, for Süreko to fulfill its legal obligations (e.g., notifications, disclosures, record‑keeping) or when necessary to establish, exercise, or protect a right.
Süreko may obtain personal data to the extent necessary for its legitimate interests, while taking care not to harm fundamental rights and freedoms. Publicly disclosed personal data may be processed by Süreko.
Personal data may also be obtained and processed to the extent necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility or whose consent is not legally valid.
PURPOSES OF PROCESSING PERSONAL DATA
Süreko may store, view, analyze, and use the above personal data in its systems of record for legitimate commercial and business purposes and in other cases permitted by law, to the extent necessary. Within these legal grounds, processing may occur for the following purposes:
- Production and manufacturing
- Shipment and transportation
- Logistics
- Stock and storage
- Ensuring efficiency and productivity
- Events and organization
- Monitoring and managing marketing and sales processes
- Tracking and fulfilling orders
- Providing after‑sales support
- Managing procurement of services, raw materials, machinery, etc.
- Ensuring physical, technical, financial, and commercial security
- Payments
- Collections
- Budgeting and financial planning; account management
- Investment
- Risk and complaint management
- Ensuring and monitoring service quality and satisfaction
- Auditing
- Product development
- Planning, statistics, and analysis
- Reporting
- Resource management
- Conducting internal administrative operations
- Maintaining contact throughout the business relationship
THIRD PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED
Within the above legal grounds and purposes, and always limited, proportionate, and relevant—and, where required, with explicit consent—personal data may be shared on a “need‑to‑know” basis with:
1) Süreko’s customers
2) Suppliers and consultants from whom Süreko obtains external services as part of its commercial activities
3) Süreko’s dealers and business partners
4) Süreko company in Türkiye and abroad, its affiliates and subsidiaries (see our group structure at www.sureko.com)
5) Legally authorized institutions and organizations
For purposes described in this policy and notice, Süreko may use certain software, programs, and databases (e.g., Microsoft Office 365, SAP) that operate on servers located outside Türkiye, for activities such as centralizing, reviewing, and securing data. For details on current server locations, you may contact Süreko as described below. Süreko takes great care to ensure that third parties to whom data are transferred act in compliance with personal data protection laws and take necessary security measures.
When entrusting Süreko with personal data of third parties (not your own) within the scope of the above commercial activities, please share only what is necessary, limit sharing to those who need to know, inform the relevant individuals, obtain explicit consent where required, and comply with applicable laws.
YOUR RIGHTS REGARDING YOUR PERSONAL DATA
Under Article 11 of Law No. 6698 on the Protection of Personal Data, you may:
- Learn whether your personal data is processed
- Request information if processed
- Learn whether your data is used in accordance with the purpose of processing
- Learn the third parties in Türkiye or abroad to whom your data are transferred
- Request correction of incomplete or inaccurate data; deletion, destruction, or anonymization of your data when processing grounds cease to exist; and request notification of these actions to third parties to whom the data were transferred
- Object to any result arising against you through exclusive analysis by automated systems
- Request compensation for damages arising from unlawful processing
To exercise your rights, submit your requests or obtain further information about this Notice, you may contact us in writing at: Egemenlik Mahallesi Eski Kemalpaşa Caddesi No: 4B Işıkkent Bornova İzmir, or via registered email (KEP), secure electronic signature, or mobile signature to sureko@hs01.kep.tr. To be processed, your application must include:
(a) Name, surname, and signature if the application is in writing
(b) Turkish ID number (for citizens), or nationality and passport number/ID number (for non‑citizens)
(c) Residential or workplace address for notifications
(d) Email address, telephone, and fax number for notifications, if any
(e) The subject of the request
Please attach all relevant information and documents so your request can be properly reviewed. We will respond as soon as reasonably possible and in any event within 30 days from receipt. If fulfilling your request requires additional cost, a fee may be charged as permitted by law.