Employee Privacy Notice
EMPLOYEE PRIVACY NOTICE UNDER THE PROTECTION OF PERSONAL DATA
In light of the Law No. 6698 on the Protection of Personal Data (“KVKK”), published in the Official Gazette dated April 7, 2016 and numbered 29677, aiming to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data, and to determine the obligations of natural and legal persons processing personal data, as Santa Farma İlaç San. A.Ş. (“Santa Farma” or the “Company”), in our capacity as Data Controller, we would like to inform you pursuant to Article 10 of the Law titled “Data Controller’s Obligation to Inform”.
Santa Farma maintains its system infrastructure and internet presentations at the most reliable level to protect the confidentiality of personal information obtained from all its employees, including those holding the status of “Intern”.
PROCESSED PERSONAL DATA
Within the scope of your relationship with Santa Farma, the following personal data of yours are processed:
- Your Identity Information
- Your Contact Information
- Your Personnel / Employment Information
- Your Legal Transaction Information
- Your Financial Information
- Your Data Relating to Commercial Life
- Your Professional Experience Information
- Information on Physical Space Security
- Visual Records
- Transaction Security Data
- Your Health Information
- Information on Criminal Convictions and Security Measures
- Call Center Records
- Family Details
- Location and Position Data
- Other Data
PURPOSE OF PROCESSING PERSONAL DATA
Santa Farma processes the data of all its employees, including those with the status of Intern, for the purpose of fulfilling employment contracts and legal obligations, organizing social activities, providing necessary training, conducting commercial relations and business processes, and protecting Santa Farma’s legitimate interests.
Your personal data shared with the Company during the establishment of your Employment Contract and throughout your employment relationship are processed for the following purposes:
| PERSONAL DATA | PROCESSING PURPOSE |
|---|---|
| Identity Information | - Execution of obligations arising from employment contract and legislation for employees - Execution of employee satisfaction and loyalty processes - Providing information to authorized persons, institutions, and organizations - Planning and auditing human resources processes - Execution of emergency management processes - Execution of fringe benefits and interests processes for employees - Execution of audit and ethics activities - Execution of occupational health and safety activities - Receiving and evaluating suggestions for the improvement of business processes - Execution of training activities - Execution of communication activities - Execution, follow-up, and auditing of business activities - Execution of finance and accounting affairs - Execution of access authorization activities - Execution of activities in compliance with legislation - Execution of assignment processes - Follow-up and execution of legal affairs - Execution of internal audit, investigation, and intelligence activities - Planning of human resources processes - Execution of business continuity activities - Execution of storage and archive activities - Execution of contract processes - Execution of management activities - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Ensuring the opening of mandatory individual pension insurance accounts - Confirming that the employee assigned or allowed to drive a vehicle is qualified to drive and has not lost their driver's license for any reason - Conducting international travel planning - Fulfillment of legal obligations - Fulfillment of obligations under KVKK |
| Contact Information | - Execution of obligations arising from employment contract and legislation for employees - Execution of emergency management processes - Execution of storage and archive policy - Execution of assignment processes - Execution of fringe benefits and interests processes for employees - Execution of activities in compliance with legislation - Execution of communication activities - Execution, follow-up, and auditing of business activities - Execution of assignment processes - Follow-up and execution of legal affairs - Execution of internal audit, investigation, and intelligence activities - Planning of human resources processes - Execution of occupational health and safety activities - Execution of business continuity activities - Execution of contract processes - Providing information to authorized persons, institutions, and organizations - Execution of management activities - Creation of employee personnel files |
| Personnel / Employment Information | - Execution of obligations arising from employment contract and legislation for employees - Execution of fringe benefits and interests processes for employees - Execution of training activities - Execution of activities in compliance with legislation - Execution of storage and archive policy - Execution of finance and accounting affairs - Execution of assignment processes - Follow-up and execution of legal affairs - Execution of internal audit, investigation, and intelligence activities - Planning and auditing human resources processes - Execution and auditing of business activities - Execution of occupational health and safety activities - Execution of business continuity activities - Execution of contract processes - Providing information to authorized persons, institutions, and organizations - Execution of management activities - Execution of payroll transactions - Employee leave approval, displaying leave balances, making leave arrangements - Execution of employee onboarding and offboarding transactions - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Ensuring the opening of mandatory individual pension insurance accounts |
| Legal Transaction Information | - Execution of obligations arising from employment contract and legislation for employees - Execution of fringe benefits and interests processes for employees - Execution of access authorizations - Execution of activities in compliance with legislation - Execution of finance and accounting affairs - Follow-up and execution of legal affairs - Execution of internal audit, investigation, and intelligence activities - Planning and auditing human resources processes - Execution and auditing of business activities - Execution of occupational health and safety activities - Execution of business continuity activities - Execution of storage and archive activities - Execution of contract processes - Ensuring the security of movable property and resources - Providing information to authorized persons, institutions, and organizations - Execution of management activities - Execution of audit and ethics activities - Making wage garnishment deduction payments to enforcement files for employees - Execution of court orders |
| Financial Information | - Execution of obligations arising from employment contract and legislation for employees - Execution of fringe benefits and interests processes for employees - Execution of activities in compliance with legislation - Execution of finance and accounting affairs - Follow-up and execution of legal affairs - Planning of human resources processes - Execution and auditing of business activities - Execution of business continuity activities - Execution of storage and archive activities - Execution of contract processes - Execution of remuneration policy - Providing information to authorized persons, institutions, and organizations - Salary payments to employees - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Ensuring the opening of mandatory individual pension insurance accounts |
| Data Relating to Commercial Life | - Execution of activities in compliance with legislation - Execution of commercial operations - Follow-up and execution of legal affairs - Execution and auditing of business activities - Execution of goods/services procurement processes - Execution of goods/services sales processes - Execution of storage and archive activities - Execution of contract processes - Providing information to authorized persons, institutions, and organizations - Execution of management activities |
| Professional Experience Information | - Execution of emergency management processes - Execution of obligations arising from employment contract and legislation for employees - Execution of audit and ethics activities - Execution of activities in compliance with legislation - Execution of assignment processes - Execution and follow-up of legal affairs - Execution of internal audit, investigation, and intelligence activities - Planning of human resources processes - Execution and auditing of business activities - Execution of occupational health and safety activities - Execution of storage and archive activities - Execution of contract processes - Execution of remuneration policy - Providing information to authorized persons, institutions, and organizations - Execution of business continuity activities - Creation of employee personnel files |
| Physical Space Security Information | - Execution of audit and ethics activities - Ensuring physical space security - Execution of activities in compliance with legislation - Execution of internal audit, investigation, and intelligence activities - Execution and auditing of business activities - Ensuring the security of movable property and resources - Providing information to authorized persons, institutions, and organizations - Execution of emergency management processes - Execution of access authorizations - Execution of business continuity activities - Execution of storage and archive activities - Detection of potential unlawful acts and obtaining evidence - Ensuring the control of employee entry and exit - Ensuring the security of data controller operations |
| Visual and Audio Records | - Execution of obligations arising from employment contract and legislation for employees - Execution of audit and ethics activities - Execution of activities in compliance with legislation - Ensuring physical space security and entry-exit control - Follow-up and execution of legal affairs - Execution of internal audit, investigation, and intelligence activities - Execution and auditing of business activities - Execution of business continuity activities - Execution of storage and archive activities - Ensuring the security of movable property and resources - Providing information to authorized persons, institutions, and organizations - Execution of management activities - Detection of potential unlawful acts and obtaining evidence - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Execution of emergency management processes - Taking photos and video recordings during social activities |
| Transaction Security Data | - Execution of emergency processes - Execution of information security processes - Execution of access authorizations - Execution of activities in compliance with legislation - Ensuring physical space security - Execution of internal audit, investigation, and intelligence activities - Execution and auditing of business activities - Execution of business continuity activities - Execution of storage and archive activities - Ensuring the security of movable property and resources - Ensuring the security of data controller operations - Providing information to authorized persons, institutions, and organizations - Execution of management activities - Ensuring the control of employee system logins and logouts - Detection of potential unlawful acts and obtaining evidence |
| Health Information | - Execution of occupational health and safety activities - Execution of obligations arising from employment contract and legislation for employees - Execution of fringe benefits and interests processes for employees - Providing information to authorized persons, institutions, and organizations - Execution of activities in compliance with legislation - Planning of human resources processes - Execution and auditing of business activities - Execution of business continuity activities - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Conducting official institution audits - Execution of emergency management processes - Execution of fringe benefits and interests processes for employees |
| Information on Criminal Convictions and Security Measures | - Follow-up and execution of legal affairs - Providing information to authorized persons, institutions, and organizations - Execution of processes regarding documents and applications required to be obtained from institutions and organizations on behalf of the company and employees within the scope of company activities - Execution of obligations arising from employment contract and legislation for employees - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Execution of fringe benefits and interests processes for employees - Execution of Occupational Health / Safety activities |
| Call Center Records | - Fulfillment of Company obligations under applicable legislation - Ensuring training of company employees for providing effective customer support services - Follow-up of requests and complaints - Execution of activities in compliance with legislation - Execution and auditing of business activities - Providing information to authorized persons, institutions, and organizations |
| Family Details | - Execution of human resources processes - Providing fringe benefits to employees - Execution of emergency processes - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Providing information to authorized persons, institutions, and organizations |
| Location and Position Data | - Tracking the use of Company vehicles for employee safety and business execution - Instant location information, speed information, vehicle usage hours, route information via GPS device in the vehicle allocated to you by the Company |
| Other Data | - Creation of employee personnel files - Making SSI notifications, İŞKUR notifications, police station notifications, and incentive and legal obligation notifications - Making training planning, reporting of trainings, preparing training certificates, tracking employees participating in trainings, tracking development processes resulting from trainings taken by employees - Conducting satisfaction survey analysis - Execution of event processes - Processing foundation and association membership information to organize event and activity management and conduct internal company meetings |
Employee personal data to be held by the employer will continue to be processed until the reasons requiring processing disappear, without prejudice to the legal obligations that Santa Farma is bound to comply with.
Santa Farma has the authority to review personal data acquired through tools allocated to employees such as telephones, computers, and email addresses—limited to the employee's business activities—when necessary, in line with business requirements and legitimate purposes, and if necessary, to use them in performance evaluation or disciplinary processes.
COLLECTION OF PERSONAL DATA AND LEGAL REASON
Santa Farma collects personal data directly from all its employees, including those with Intern status, as well as through written, verbal, and electronic media, third parties, and legal authorities based on the legal reasons specified in Article 5/1 (explicit consent of the data subject), Article 5/2/a (explicitly provided for in laws), Article 5/2/c (necessary for the establishment or performance of a contract), Article 5/2/ç (necessary for the data controller to fulfill its legal obligation), Article 5/2/e (necessary for the establishment, exercise, or protection of a right), and Article 5/2/f (necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject) of the Law; and regarding special categories of personal data pursuant to Article 6/3 of the Law: 6/3-a (explicit consent), 6/3-b (explicitly provided for in laws), 6/3-d (necessary for the establishment, exercise, or protection of a right), 6/3-e (necessary for public health protection, preventive medicine, medical diagnosis, treatment and care services, planning, management, and financing of health services by persons bound by confidentiality obligations or authorized institutions), and 6/3-f (necessary for fulfilling legal obligations in employment, occupational health and safety, social security, social services, and social assistance). Personal data transfers are conducted within the framework of Article 8 for domestic transfers and Article 9 for cross-border transfers. Adequate measures determined by the Board pursuant to Article 6/4 are taken in processing special categories of personal data.
TRANSFER OF PROCESSED PERSONAL DATA
Santa Farma may share data with domestic and foreign third parties from whom services are received for providing products/services or contract execution, overseas units of Santa Farma, individuals/institutions providing consultancy/services (at Santa Farma's discretion to enter into confidentiality agreements), business partners, and third parties with whom joint work is conducted. If Santa Farma transfers your personal data abroad, this transfer is carried out under Article 9 of the Law and the Regulation on Procedures and Principles Regarding Cross-Border Data Transfers; provided that an adequacy decision exists under Art. 9/1, or in its absence, one of the appropriate safeguards listed in Art. 9/4 is provided.
Records and documents concerning transactions executed with all employees (including Interns) are stored by Santa Farma for a specific duration under legal regulations and internal policies. If you request deletion, destruction, or anonymization of your personal data, this request will be fulfilled by Santa Farma within the statutory timeframe if necessary legal conditions are met; however, upon expiration of this period, your data will no longer be processed by Santa Farma nor shared with third parties, except for obligations arising from national/international laws, regulations, and contracts.
Your personal data shared with our Company during onboarding and throughout your employment are shared with recipient groups specified in the table below for the stated purposes and legal reasons, by taking all necessary technical and administrative measures to ensure appropriate security levels pursuant to KVKK and relevant legislation.
| RECIPIENT | TRANSFER PURPOSES | LEGAL REASONS |
|---|---|---|
| Institutions and organizations legally authorized to request information and judicial authorities (SSI, İŞKUR, Judicial and Administrative Authorities, Tax Offices, Trade Registry Directorates, Chambers of Commerce) | Your personal data is transferred limited to the purpose requested within the legal authority of the relevant institutions and organizations, primarily for conducting legally required information sharing, legal reporting, conducting regulatory and supervisory activities under relevant legislation, conducting commercial activities, and communicating with authorized institutions and organizations, especially for following up legal processes. |
|
| Persons, organizations, financial institutions, and other third parties required to share data under relevant legislation for the Company to carry out its activities and fulfill legal obligations, public legal entities such as TR Ministry of Trade and affiliated directorates, TR Ministry of Health and affiliated directorates, Turkish Medicines and Medical Devices Agency, and SSI | Your personal data is transferred limited to the purpose requested within the legal authority of relevant institutions and organizations, for the purposes of enabling Company activities, obtaining information and documents in this context, and fulfilling legal obligations. |
|
| SSI incentive consultancy firm | Your personal data is transferred limited to this purpose to enable our Company to benefit from SSI incentives. |
|
| Law firm | Your personal data is transferred limited to the purposes of following up all legal dispute processes, including lawsuits and enforcement proceedings, and informing judicial authorities. |
|
| Suppliers, consultants, service providers, and other business partners (Certified Public Accountant, Customs Broker, Server Hosting Company) | Your personal data is transferred for the purpose of establishing necessary business collaborations and receiving services to carry out Company activities. |
|
| Independent audit firms | Your personal data is transferred limited to the purpose of ensuring that Company activities are conducted in accordance with the law. |
|
| Shareholders | Your personal data is transferred to our Company's shareholders limited to audit purposes in accordance with relevant legislative provisions. |
|
| Software / Programs Used by Human Resources | Your personal data is transferred for the purposes of tracking HR processes for employees, executing/updating/tracking payroll transactions, managing salary and fringe benefits processes, and monitoring entry-exits. |
|
| Internal Announcements | Your personal data is transferred to other Company employees through announcements made on special days of employees. |
|
| Relevant Internal Departments | Your personal data is transferred to relevant departments for the execution of Company business and operational processes. |
|
STORAGE AND DESTRUCTION PROCESS OF PERSONAL DATA
In accordance with KVKK provisions, your personal data processed for the purposes specified in this “Employee Privacy Notice under the Protection of Personal Data” will be deleted, destroyed, or anonymized by us under our Personal Data Retention and Destruction Policy pursuant to Article 7 of KVKK when the purpose requiring processing disappears and/or statutory limitation periods requiring us to process your data expire.
Documents obtained containing special categories of personal data will be destroyed after inspection in line with occupational safety requirements by taking necessary measures. These documents will not be stored or retained.
RIGHTS OF THE DATA SUBJECT WHOSE PERSONAL DATA IS PROCESSED
Regarding your personal data processed by Santa Farma, you may at any time submit your requests under Article 11 of KVKK in writing in accordance with the Communiqué on Principles and Procedures for Application to the Data Controller, or via registered electronic mail (KEP), electronic signature, mobile signature, or using your email address previously notified to us and registered in our systems, to the addresses listed below.
IDENTITY OF THE DATA CONTROLLER
Data Controller: Santa Farma İlaç Sanayii A.Ş.
Address: H. Edip Adıvar / Boru Çiçeği Sokak / No:16 Şişli / İstanbul
MERSİS No: 0744001139900019
Email Address: kvkk@santafarma.com.tr
KEP Address: santafarmaas@hs01.kep.tr
Requests submitted within this scope will be concluded free of charge by Santa Farma as soon as possible and within thirty days at the latest. However, if a fee is prescribed by the Personal Data Protection Board, the fee specified in the tariff determined by our Company will be charged.
Data Controller
Santa Farma İlaç San. A.Ş.
............................................................
(The employee must write in handwriting: “Received by Hand”.)
I have read and understood the Employee Privacy Notice under the Protection of Personal Data.
| Date | : | |
| First Name | : | |
| Last Name | : | |
| Signature | : |