GDPR Policy

KVKK Policy

Introduction

According to Article 20 of the Constitution of the Republic of Turkey, everyone has the right to request the protection of their personal data. Regarding the protection of personal data, which is a constitutional right, this personal data protection policy created by Volta Motor San ve Tic. A.Ş. (“Volta”) in its capacity as the Data Controller shall manage the process of securely protecting the personal data of natural persons such as company employees, job applicants, interns, suppliers, supplier employees, subcontractors, subcontractor employees, customers, third parties, and visitors. All necessary administrative and technical measures have been taken by Volta for the protection of personal data processed in accordance with the Personal Data Protection Law No. 6698 and secondary legislation.

Purpose

The primary purpose of Volta in implementing this KVKK policy is to ensure the security of personal data processed by automated means or non-automated means provided that it is part of any data recording system, of the natural persons mentioned above, primarily company employees, with whom it has legal and commercial relationships, through administrative and technical measures taken within the scope of lawful personal data processing and data protection activities.

Scope

The KVKK policy relates to all personal data of employees, customers, subcontractors, subcontractor employees, suppliers, supplier employees, job applicants, interns, third parties, and visitors at Volta, processed by automated means or non-automated means provided that it is part of any data recording system.

Data Controller's
Personal Data Processing Purpose

In this context, Volta processes personal data for the following purposes:

– Carrying out corporate sustainability activities,
– Management of relationships with suppliers and subcontractors,
– Execution of personnel recruitment processes,
– Execution of internal audit and legal processes,
– Carrying out corporate management and communication activities,
– Demand and complaint management,
– Providing information to authorized persons or institutions arising from legislation,
– Creation and tracking of visitor records,

If the processing activity carried out for the above-mentioned purposes does not meet any of the conditions envisaged under Law No. 6698, explicit consent is obtained from the data subjects by Volta regarding the relevant processing process.

Principles of
Personal Data Processing

Volta Motor San. Ve Tic. conducts its work within the scope of this Policy, adopting the basic principles listed below regarding the processing of personal data:

Processing personal data in accordance with the law and principles of good faith,
Keeping personal data accurate and, where necessary, up-to-date,
Processing personal data for specified, explicit, and legitimate purposes,
Processing personal data in a manner relevant, limited, and proportionate to the purpose for which they are processed,
Retaining personal data for the period prescribed by relevant legislation or required for the purpose for which they are processed,
Enlightening and informing personal data subjects,
Establishing the necessary system for personal data subjects to exercise their rights,
Taking necessary measures for the protection of personal data,
Acting in accordance with relevant legislation and Personal Data Protection Board regulations when transferring personal data to third parties in line with the requirements of the processing purpose,
Showing the necessary sensitivity to the processing and protection of special categories of personal data.

Conditions for
Personal Data Processing

Volta processes personal data under the conditions listed below within the scope of the KVKK policy:

If the processing of personal data is explicitly provided for by law,
If the processing of personal data is directly related to and necessary for the conclusion or performance of a contract,
If it is necessary for Volta to fulfill its legal obligation, if the personal data has been made public by the data subject,
If the processing of personal data is necessary for the establishment, exercise, or protection of rights of the data subject or third parties,
If it is necessary to process personal data for the legitimate interests of Volta, provided that it does not harm the fundamental rights and freedoms of the data subject,
If the processing of personal data is necessary for the protection of the life or physical integrity of the data subject or another person, and the data subject is unable to give their consent due to actual or legal incapacity.

Ensuring the Security
of Personal Data

Volta takes all necessary technical and administrative measures according to available technological capabilities and applications to ensure that personal data is processed in accordance with the law. In this context;

The system established within the company for personal data processing activities to ensure the lawful processing of personal data by IT experts appointed by Volta is audited by the IT Department, and technical measures taken are periodically reported to senior management as required by the internal audit mechanism.

Employees are trained and their level of knowledge and awareness regarding personal data protection law and the lawful processing of personal data is increased.

Business processes carried out by all units operating within Volta have been analyzed, personal data has been identified, data processors have been determined, job descriptions have been made, and data processing agreements have been signed with each of them.

Personal data processing activities carried out by all units of Volta have been determined in accordance with the personal data processing conditions required by Law No. 6698.

Records imposing the obligation not to process, disclose, use, or share personal data unlawfully are included in documents revealing the legal relationship between Volta and its employees, interns, job applicants, subcontractors, and suppliers, and awareness of this issue is increased among employees and other persons, and audits are carried out.

Volta takes technical measures in line with technological developments, and the measures taken are periodically updated and renewed.

Access authorizations to personal data are restricted, authorization matrices are created, and authorizations are reviewed regularly.

Software and hardware including virus protection systems and firewalls are installed.

Regular security scans are performed to identify security vulnerabilities in applications where personal data is collected.

Employees are informed that personal data learned as a requirement of the job cannot be disclosed to others contrary to the provisions of Law No. 6698, cannot be used for purposes other than processing, and this obligation continues after they leave their position, and the necessary commitments are obtained from them in this direction.

Provisions are added to contracts (confidentiality agreements) concluded with subcontractors and suppliers that Volta is in a business relationship with, regarding the taking of necessary security measures and ensuring that these measures are complied with in their own organizations.

Backup programs are used in accordance with the law to ensure the secure storage of personal data.

Access to data storage areas where personal data is located is logged, and unauthorized access or attempts to access are instantly transmitted to the relevant parties.

Data Subject's Rights
and Application Process

The rights possessed by data subjects under Article 11 of Law No. 6698 regarding personal data shared with the company within the scope of the purposes and methods of personal data processing specified in this Policy of Volta are listed below:

Learning whether personal data has been processed,
Requesting information if personal data has been processed,
Learning the purpose of personal data processing and whether it is used in accordance with its purpose,
Knowing the third parties to whom personal data is transferred domestically or abroad,
Requesting correction of personal data in case of incomplete or incorrect processing,
Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Law No. 6698,
Objecting to the emergence of a result against the person themselves by analyzing the processed data exclusively through automated systems,
Requesting compensation for damages in case of loss due to unlawful processing of personal data.

To exercise the rights listed above, you may contact our company by using the "Application Form" available on our website at http://www.volta.com.tr and the methods specified in this form. Requests transmitted by the personal data subject in accordance with the above application will be finalized by Volta free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request.

Data Retention
Periods and Destruction Method

Volta retains personal data for the periods prescribed in relevant laws, legislation, and the “Personal Data Retention and Destruction Policy”. If no period is foreseen in the legislation regarding how long personal data should be retained, the data is retained according to the practices carried out by Volta and the customs necessitated by the commercial life of the company, and is subsequently deleted, destroyed, or anonymized. However, even if the purpose of processing personal data has ended, it may be retained for the purpose of serving as evidence in possible legal disputes, or to assert the relevant right related to personal data or to establish a defense. Even in such cases, retained personal data is not accessed for other purposes, and access to data is provided only for use in relevant legal disputes. In any case, at the end of the period in question, personal data is destroyed using one or more of the technical methods specified in the "Personal Data Retention and Destruction Policy" that are most suitable for the company's business processes and activities. Records kept regarding camera surveillance are deleted every 30 days.

Data Subject Group
and Data Categories

Under this Policy, Volta processes the data of the individuals listed below. These individuals include company employees, job applicants, interns, suppliers, supplier employees, subcontractors, subcontractor employees, third parties, and visitors. In accordance with the Labor Law No. 4857, Volta processes the identity, contact, location, family and kinship, criminal record, visual, educational, financial, personnel, health, and biometric data of individuals employed based on an employment contract and whose personal data are obtained through employment relations. Volta processes the identity, contact, criminal record, visual, financial, personnel, and health information of natural persons employed by subcontractors who undertake a portion of the main work or auxiliary works under Law No. 4857, and employees employed by suppliers with whom a supplier contract has been signed for the purpose of service provision; the identity, contact, visual, signature, and financial information of subcontractors and suppliers; the identity, contact, criminal record, visual, financial, personnel, and health information of natural persons performing internships under the Vocational Education Law No. 3308; the identity, contact, educational, and location information of job candidates who have applied for a job by any means or who have made their resumes and related information available for our company's review; the identity information of third parties such as family members, relatives, and former employees who do not fall within the scope of this Policy; and the identity and visual information of natural persons who are visitors having entered the physical premises owned by the company for various purposes.

Transfer of
Personal Data

In accordance with Articles 8 and 9 of Law No. 6698, Volta may transfer the personal data of data subjects governed by this Policy to the categories of persons listed below:

– To Volta’s senior executives,

– To Volta’s authorized representatives,

– To legally authorized persons, institutions, and organizations, and to legally authorized private law entities.

Volta does not transfer the personal data it processes under this policy abroad. The relevant legal regulations in force regarding the processing and protection of personal data are primarily applied. In case of any discrepancy between the legislation in force and the Policy, Volta acknowledges that the legislation in force shall apply. This Policy may be amended or updated in line with new legal regulations and company policy. The new policy text reflecting all these changes and updates is announced to the relevant persons via the website. Cookies aimed at tracking the site usage habits of online visitors are used on the www.volta.com.tr website.

Camera Surveillance Activities
in Buildings and Facilities

Volta’s camera surveillance activities are carried out in accordance with the Law on Private Security Services and related legislation, Law No. 6698, and the personal data processing conditions stipulated in the “Volta Motor San. ve Tic. A.Ş. Camera Surveillance Policy.” The camera surveillance activity is conducted for the purpose of ensuring the security of the company and the health and safety of other individuals. Data subjects are informed about the camera surveillance activities conducted by Volta in accordance with Article 10 of Law No. 6698. Camera recordings are not shared with anyone other than authorized persons, institutions, or organizations.

Effective Date

This Policy, to be implemented by Volta Motor San. ve Tic. A.Ş., shall enter into force on August 9, 2019.