Personal Data Protection and Processing Policy

1. Introduction

1.1. Purpose

Within the scope of the law no. 6698 – The Law On Protecting Personal Data (Law), as Tracer Software Technologies, Inc., protecting and committing personal data constitutionally is our first priority. We follow the same principle in all our planning and business activities. In accordance with the 10th article of the law, we submit Personal Data Protection and Processing Policy (Policy) for your information in order to enlight and inform you of all administrative and technical measures that we will implement in the processing and protection of personal data.

1.2 Scope

This Policy determines the conditions for the processing of personal data and sets out the principles adopted by Tracer in the processing of personal data. In this context, Policy; includes all personal data processing activities, all processed personal data, and the owners of these data under the Law performed by Tracer.

1.3 Definitions

Explicit Consent	Consent that is related to a specific issue based on information and expressed with free will.
Anonymization	To render data in such a way that it can no longer be associated with an identified or identifiable person, even when the personal data is matched with other data.
Employee Candidate	Real persons who are not employed by Tracer but who are job candidate status.
Personal Data	All information related to a real person whose identity is known or could be identified.
Data Owner	A natural person whose personal data is processed.
Processing of Personal Data	Any operation such as the obtaining, recording, keeping, storing, changing, re-arranging, disclosing, transferring, taking over, making available, classifying, or prevention of use personal data by means of wholly or partly automated procedures or via non-automated procedures provided such procedure is carried out as part of any data recording system.
Law	Protection of Personal Data Law No. 6698, promulgated in the Official Gazette No. 29677 dated 7 April 2016
Private Personal Data	Biometric and genetic information concerning race; ethnicity; political opinions; religion, sect or other beliefs; appearance; subscriptions to associations; foundations or syndicates; health; sex life; convictions; and data concerning security measures.
Policy	Tracer Software Technologies Inc. Personal Data Protection and Processing Policy
Company	Tracer Software Technologies Inc.
Data Operator	A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by him.
Data Controller	A natural or legal person who is responsible for setting up and managing the data recording system, determining the purposes and means of processing personal data.
Data Recording System	It is a recording system in which personal data is structured and processed according to certain criteria.
Business Partners	Persons with whom Tracer has established a contractual relationship within the framework of its commercial activities.

1.4 Implementing the Policy

This policy, arranged by Tracer, is implemented on May, 25 and released to the public. Especially the Law, in case of contradiction between the legislation in force regulations in this policy, legislation provisions will apply.

Tracert, yasal düzenlemelere paralel olarak Politika’da değişiklik yapma hakkını saklı tutar. Politika’nın güncel haline Tracer (www.tracer.com) web sitesinden erişilebilirsiniz.

Tracer reserves the right to make changes to the Policy in accordance with legal regulations. Latest update of the Policy is available on Tracer (www.tracer.com.tr)

2. Information On Tracer’s Personal Data Processing Activities

2.1 Data Owners

Policyholders are all natural persons, except Tracer employees, whose personal data is processed by Tracer. In general, data owners can be listed as follows;

Data Owners Categories	Explanation
Customers	It refers to real persons who benefit from Tracer’s products and services.
Potential Customers	It refers to real persons who are interested in the products and services offered by Tracer and have the potential to become customers.
Job Candidates	It refers to real persons who apply for a job by sending CV to Tracer or by other means.
Third Parties	The data categories mentioned above refer to real persons except Tracer employees.

The data owner categories described in the table above are stated on the purpose of general information sharing. In case the data owner is not covered by any of these categories does not eliminate the qualification of the data owner as specified in the Law.

2.2 Purposes of Processing Personal Data

2.2.1 Carrying out the necessary work and carrying out the business processes in order to utilize the products and services offered by Tracer to the related persons:

Planning and executing sales processes of products and/or services.
Planning and/or executing after-sales support services activities.
Planning and executing customer relationship management process.
Monitoring of contractual process and/or legal requests.
Monitoring of customer requests and/or complaints.

2.2.2 Planning and executing Tracer human resources policies and processes:

Planning and execution of talent-career development activities,
Fulfillment of obligations arising from employment contract and/or legislation for the employees of the Company,
Planning and executing fringe benefits and advantages for employees,
Planning and conducting orientation activities,
Planning and execution of personnel checkouts,
Wage management
Planning the process of human resources,
Managing the process of staff procurement,
Planning and executing placement-promotion or quitting processes of the company,
Planning and executing performance evaluation processes for the employee
Tracking and/or supervision of the employees’ work activities, Planning and conducting training activities in the company,
Planning and executing employee satisfaction and/or loyalty processes.
Planning and executing the processes of receiving and evaluating suggestions for improving the work and/or production processes of the employees.
Internship and/or student recruitment, placement, and operation planning and/or execution

2.2.3 For the commercial activities carried out by Tracer to realize the necessary working by the relevant business units and conduct business processes related to it:

Event management,
Planning and execution of business activities,
Planning and executing corporate communication activities,
Planning and executing supply chain management processes,
Planning and execution of production and/or operation processes,
Planning, auditing and executing information security processes,
Establishment and management of information technology infrastructure,
Planning and execution of business partners' access to information,
Finance and accounting works follow-up,
Planning and executing institutional sustainability activities
Planning and executing institution management activities,
Planning and/or providing business continuity activities,
Planning and execution of logistics activities.

2.2.4 Planning and executing the activities required to suggest and promote the products and services offered by Tracer to the relevant persons by being customized according to their taste, usage habits, and needs:

Determining and/or evaluating the people to be the subject of marketing activities, in accordance with the criteria of consumer behavior.
Designing and/or executing customized marketing and/or promotional activities.
Designing and/or executing advertising and/or promotional and/or marketing activities in digital and/or other media,
Designing and/or conducting activities to be developed on customer acquisition and/or value creation in existing customers in digital and/or other media
Planning and/or conducting data analytical studies for marketing purposes.
Planning and executing the marketing processes of products and/or services,
Planning and/or executing the processes of establishing the commitment and/or increasing to the products and/or services offered by the company.

2.2.5 Planning and implementation of Tracer’s commercial and/or business strategies:
Managing relationships with business partners.

2.2.6 Ensuring the legal, technical and commercial occupational safety of Tracer and the persons involved in the business relationship with Tracer:

Follow-up of legal affairs
Planning and carrying out the necessary operational activities to ensure that the company’s activities are carried out in accordance with the company procedures and/or the relevant legislation,
Giving information to the competent authorities from the legislation
Creating and following up visitor registers,
Planning and executing emergency management processes,
Realization of company and partnership law transactions,
Planning and carrying out supervision activities of the company,
Planning and/or performing occupational health and/or safety processes,
Realization of risk management of the credit processes
Ensuring the security of campuses or facilities of the company
Ensuring the security of company operations
Planning and/or executing financial risk processes of the company
Ensuring the security of assets and resources of the company

2.3 Personal Data Categories

Personal data which is categorized as follows by Tracer is processed according to the personal data processing requirements set out in the Law and the applicable legislation:

Data Category	Explanation
Identifying Information	Information on documents such as driving license, birth certificate, residence, passport, legal identity, marriage certificate
Contact Information	Information used to contact the person (eg e-mail address, phone number, mobile number, address).
Location Information	Any type of information that detects the location of the data owner. (eg. location information stored while driving)
Customer Information	Information on customers who benefit from our products and services (eg customer ID, occupational information, etc.).
Customer Transaction Information	Information on any transactions performed by customers who benefit from our products and services.
Physical Space Safety Information	Personal data related to records and documents such as camera records, fingerprint records taken the entrance to the physical space during the stay in the physical space.
Process Security Information	Personal data processed to ensure technical, administrative, legal and commercial security when conducting Tracer’s commercial activities.
Financial Information	Personal data processed in relation to the information, documents, and records showing all kinds of financial results created according to the type of legal relationship that Tracer establishes with the personal data owner.
Job Candidate Information	Personal data relating to individuals who have applied to be Tracer employees or are considered as candidates for employment in accordance with human resources needs in accordance with commercial custom and honesty rules or who are in a working relationship with Tracer
Legal and compliance information	Personal data processed within the scope of determination, follow-up, and execution of legal debts and rights of Tracer, legal obligations and compliance with company policies.
Supervision and Inspection Information	Personal data processed in accordance with Tracer’s legal obligations and compliance with company policies
Special Data Information	Person’s about the race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, disguise and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures.
Marketing Knowledge	Personal data processed for the marketing of products and services offered by Tracer in accordance with the usage habits, tastes, and needs of the personal data owner and the reports and evaluations created as a result of these processing results.
Request / complaint management information	Personal data relating to the receipt and evaluation of any request or complaint addressed to Tracer.
Reputation management knowledge	Information gathered for the purpose of protecting Tracer’s commercial reputation, and evaluation reports and actions taken related to that.
Event management information	Personal data processed in order to take necessary legal, technical and administrative measures to protect the rights and interests of Tracer's commercial rights and interests and to protect the rights and interests of its customers.

3. Terms and Conditions for the Processing of Personal Data

Tracer, in accordance with Article 4 of the Law on the processing of personal data; conducts personal data processing in a limited and measured manner in accordance with the purpose, in accordance with the law and with the rules of honesty, with correct and up-to-date, specific, clear and legitimate purposes. Tracer maintains personal data for as long as required by law or for the purpose of personal data processing.

3.1 Principles Regarding the Processing of Personal Data

Tracer is to enlighten the data owners in accordance with Article 10 of the Personal Data Protection Law, and in cases where consent is required, they request their consent from the data owners and process this personal data on the basis of the following principles.

3.1.1 Processing of Data in accordance with Law and Integrity Rule

Tracer complies with the principles of legal regulations and trust and honesty in the processing of personal data. In accordance with the principle of honesty, Tracer considers the interests and reasonable expectations of the persons involved in its efforts to achieve its goals in data processing.

3.1.2 Ensuring that personal data is accurate and up-to-date when necessary

Accurate and up-to-date retention of personal data is necessary for Tracer to protect the fundamental rights and freedoms of the person concerned. Tracer has an active obligation to ensure that personal data are accurate and up-to-date when necessary. Therefore, all communication channels are open to ensure that Tracer maintains accurate and up-to-date information about the person who has the data.

3.1.3 Processing of Data for Specific, Clear and Legitimate Purposes

Tracer determines the purpose of legitimate and justifiable personal data processing. Processes as much personal data as is necessary for and in connection with the commercial activity it is conducting.

3.1.4 Connected, Limited and Balanced with The Purpose of Processed Data

Tracer processes personal data for the necessary purposes of business and area of concern. Therefore, it processes personal data in a manner that is suitable for the achievement of the specified objectives and avoids the processing of personal data that is irrelevant and not needed to achieve the objective.

3.1.5 Conservation of Data for the Period That Envisaged by Applicable Legislation or Purpose of Processing

Tracer retains personal data only for the period required for the purpose which they are specified or processed in the applicable legislation. In this context, firstly, it determines whether a period is stipulated in the relevant legislation for the storage of personal data, acts in accordance with this period if a period is determined, and if it is not determined, it stores the personal data for the period required for the purpose for which it is processed. Tracer deletes, destroys or anonymizes the personal data after the purpose of personal data processing has ceased or after the expiry of the period prescribed by the legislation.

3.2 Conditions related to the processing of personal data

Your personal data is processed by Tracer in the presence of at least one of the personal data processing conditions stated in Article 5 of the Law.

3.2.1 The direct consent of the owner of the personal data

One of the conditions for the processing of personal data is the direct consent of the owner. The direct consent of the personal data holder should be disclosed on a particular subject based on information and free will.

In order to process the personal data in accordance with the direct consent of the personal data owner, direct consent is obtained from the customer, potential customer, and visitors with the relevant methods.

3.2.2 Activities of personal data processing is envisioned clearly in the Law

The personal data of the data owner may be processed in accordance with the law without the direct consent of the data owner is clearly envisioned in the law.

3.2.3 Failure to gain direct consent of the person due to actual impossibility

Personal data of the data owner may be processed if it is necessary to process the personal data of the person who is unable to disclose his consent due to the impossibility or whose consent shall not be validated or to protect the life or body integrity of another person.

3.2.4 Personal data is directly related to the formation or performance of a contract

Provided that a contract is formed or directly related to its performance, it is possible to process personal data if it is necessary to process the personal data of the parties to the contract.

3.2.5 Tracer meets its legal obligation

If it is necessary for Tracer to fulfill its legal obligations as a data officer, the personal data of the data owner can be processed.

3.2.6 Publicizing the data owner’s personal data

If the data owner has publicized his personal data, the relevant personal data may be processed.

3.2.7 Obligation of data processing for the establishment or protection of a right

If it is necessary to process data for the establishment, use or protection of a right, the personal data of the owner may be processed.

3.2.8 Obligation of data processing for Tracer’s legitimate interest

Without harm to the fundamental rights and freedoms of the personal data holder, the personal data of the data holder may be processed if it is compulsory for Tracer to process data for its legitimate interests.

3.3 Processing of Sensitive Personal Data

In the processing of personal data determined by Personal Data Protection Law as “sensitive”, it is strictly complied with regulations stipulated in the Personal Data Protection Law.

By Tracer; sensitive personal data are processed in the following cases, provided that adequate measures are taken by the Personal Data Authority:

If the personal data owner has explicit consent, or
If the personal data owner does not have explicit consent;
Except for the health and sexual life of the personal data owner, sensitive personal data are as stipulated in the law.
The sensitive personal data of the personal data owner’s health and sexual life is only processed on the purpose of protection of public health, preventive medicine, medical diagnosis, treatment, and care services, health services and the planning and management of financing by people who meet the obligation to confidentiality or authorized institutions and organizations.

4. Transferring Personal Data

Tracer can transfer the personal data and sensitive personal data of the data owner to third parties in Turkey or abroad by taking the necessary security measures in accordance with the lawful personal data processing purposes. In this respect, Tracer acts in accordance with the regulations stipulated in Article 8 of the Personal Data Protection Law.

4.1 Transfer of personal data to third parties in Turkey

Your personal data may be transferred by Tracer in the presence of at least one of the data processing conditions in Articles 5 and 6 of the law and described in Chapter 3 of this policy, and in accordance with the basic principles of data processing condition.

4.2 Transfer of personal data to third parties abroad

Tracer may transfer the personal data and sensitive personal data of the data owner to third parties abroad in the presence of at least one of the data processing conditions described in Chapter 3 of this policy and taking necessary security measures. Personal data is transferred to the countries declared as countries have adequate data protection (“Foreign Countries Have Adequate Data Protection”) or in case of the absence of adequate protection, countries which guarantees adequate protection in writing by data controllers and to foreign countries which Personal Data Protection Law Authorization permits. Tracer acts in accordance with the regulations stipulated in Article 9 of the Personal Data Protection Law.

4.3 Third parties to whom personal data are transferred and the purposes for which they are transferred

Tracer is able to transfer data to the parties categorized in the following table in accordance with the general principles of the law and the data processing conditions in Article 8 and 9.

Persons Who Can Transfer Data	Definition	Purpose
Business Partner	The parties with Tracer establishes a business partnership in carrying out its commercial activities	Sharing of personal data finitely to ensure the fulfillment of the objectives of the partnership.
Shareholders	Shareholders authorized to design Tracer’s commercial strategies and audit activities in accordance with the applicable legislation	Designing strategies for Tracer’s commercial activities and sharing personal data for audit purposes
Company Officials	Board members and other authorized persons	Designing strategies for Tracer’s commercial activities, ensuring the highest level of management, and sharing personal data for audit purposes
Legally Authorized Public Institutions and Organizations	Public institutions and organizations legally authorized to receive information and documents from Tracer	Personal data sharing on the purpose of requesting information by concerned public institutions and organizations
Legally Authorized Private Entities	Legal persons who are legally authorized to receive information and documents of Tracer	Limited sharing of data fort he purpose requested by the concerned legal persons within the legal authority

5. Rights of Data Owner and the Use of the Rights

5.1 Rights of the personal data owner:

To learn whether personal data is processed or not,
Requesting information if personal data is processed,
Learning the purpose of processing personal data and whether they are used in accordance with their purpose.
Consciousness of the third parties to whom personal data is transferred in Turkey or abroad
Requesting a revision and to inform the third parties to whom the personal data is transferred if the personal data is incomplete or processed incorrectly,
To request the deletion or destruction of personal data in the event that the reasons that require processing are eliminated, although it has been processed in accordance with the provisions of the Personal Data Protection Law and other laws.
Objection to this result if the processed data is analyzed exclusively through automated systems if a result arises against the person himself,
To demand compensation, in case of damages due to illegal processing of personal data

If personal data is not obtained directly from the data owner; within a reasonable period of time from the receiving personal data(1), if the personal data will be used for the purpose of communication with the person(2), if the personal data will be transferred(3), at the latest during the transferring process, Tracer conducts activities for enlighten the data owners.

5.2 Situations that the personal data owner cannot claim his or her rights:

Personal data owners cannot assert their rights listed in 5.1 as the following cases are excluded from the scope of the Personal Data Protection Law in accordance with Article 28 of the Personal Data Protection Law.

Processing of personal data in the scope of activities related to him or his family members living in the same dwelling by real persons provided that they are not given to third parties and the data security obligations are followed
Processing of personal data for purposes such as research, planning, statistics through anonymization with official statics
Processing of personal data for art, history, literature or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public security, public order, economic security, privacy or privacy rights or constitute a crime,
Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to provide national defense, national security, public security, public order or economic security
Processing of personal data by judicial authorities or enforcement authorities with respect to investigations, prosecutions, proceedings or executions.

According to the Article 28.2 of the Personal Data Protection Law, personal data owner cannot assert any other rights listed in 5.1, except for the right to claim damages.

Processing of personal data is necessary for crime prevention or criminal investigation,
Processing of personal data is publicized by the personal data owner itself,
Processing of personal data is required for the conduct of supervisory or regulatory duties, and for disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations in the nature of public institutions based on the authority granted by law.
That personal data processing is necessary to protect the economic and financial interests of the State concerning budget, tax, and financial matters

6. Deletion, Destruction, Anonymization of Personal Data

Although it has been processed in accordance with the provisions of the relevant law as provided for in Article 138 of the Turkish Penal Code and Article 7 of the Personal Data Protection Law when the necessity of processing is removed, destroyed or anonymized upon the request of Tracer or personal data owner. In this context, Tracer takes necessary technical and administrative measures within the company in order to fulfill its obligation; and it has developed the necessary functioning mechanisms in this regard; In order to act in accordance with these obligations, it educates the concerning business units and assigns them and ensures their awareness.

Contact Us

Mail: info@tracer.com.tr

About Us

Documents

Tracer Task

Tracer Project

Tracer Q