Terms and Conditions

GSI GENERAL SURVEY GÖZETME A.Ş. INTEGRATED PRIVACY NOTICE FOR CUSTOMERS AND EMPLOYEES

As GSI GENERAL SURVEY GÖZETME A.Ş. ("the Company"), we act as the "Data Controller" pursuant to the Law on the Protection of Personal Data No. 6698 ("KVKK"). This notice aims to inform you about the processing of your personal data regarding your transactions via our website (www.generalsurvey.com.tr) and our mobile application (collectively referred to as the "Platform"), in accordance with Article 10 of the KVKK and the GDPR.

ARTICLE 1: DATA CONTROLLER

Your personal data will be processed by GSI GENERAL SURVEY GÖZETME A.Ş. as the data controller.

• Address: Küçükbakkalköy, Kocasinan Cd No:48/A Doğan Plaza 34750, Ataşehir/Istanbul
• E-mail: info@generalsurvey.com.tr
• Website: www.generalsurvey.com.tr

ARTICLE 2: PROCESSED PERSONAL DATA GROUPS

Depending on your legal relationship with the Company (as a Customer or an Employee), the following data categories are processed:

• Identity Data: Name and surname shared during membership or employment.
• Contact Data: Phone number, e-mail address, physical address, and corporate contact details.
• Transaction Security Data: IP address, logs, username, and password information.
• Sensitive Personal Data (For Employees): Health status information, disability status, and HES code (where legally required or necessary for operations).
• Other Data (For Employees): Location data and camera activation (limited strictly to document/photo upload purposes).

ARTICLE 3: PURPOSES OF PROCESSING PERSONAL DATA

Your data is processed for the following purposes:

• Planning and executing human resources and recruitment processes.
• Ensuring the performance of contracts, protocols, and procedures.
• Fulfilling legal obligations (Labor Law, Occupational Health and Safety Law, Social Security Law, Turkish Commercial Code, Tax Procedure Law, etc.).
• Maintaining accreditation requirements (ISO 17020) and ISO 9001 standards as a surveillance firm certified by TÜVNORD, DAKKS, and TURKAK.
• Management of production, operation, sales, finance, and archiving activities.
• Evaluating customer complaints/suggestions and preparing certificates.
• Ensuring information security and exercising legal rights arising from current legislation.

ARTICLE 4: RIGHTS AND OBLIGATIONS OF THE COMPANY

The Company processes data in accordance with the principles of lawfulness, accuracy, transparency, and proportionality. To ensure data security, the following measures are implemented:

• Data Transmission: All data received via the Platform is transferred using TLS 1.2/1.3 protocols and SSL certificates.
• Encryption: Passwords defined on the Platform are stored using the SHA256 hashing system.
• Audits: Periodic penetration tests are conducted to ensure system resilience against unauthorized access.
• Access Control: Access and authorization matrices have been established; physical documents are stored in locked cabinets accessible only by authorized personnel.

ARTICLE 5: TRANSFER OF PERSONAL DATA

Your personal data may be shared with the following parties within the framework of legal obligations or performance of services:

• Legally authorized public institutions and organizations (Courts, Ministries, etc.).
• Program partners, service providers, and outsourced business partners (Cloud services, independent auditors, financial advisors).
• Shareholders, subsidiaries, and legal consultants.

Storage: Data collected through the Platform is stored on AWS (Amazon Web Services) infrastructure. During transfer, SSL/TLS layers are utilized to prevent data breaches.

ARTICLE 6: METHOD AND LEGAL BASIS OF DATA COLLECTION

Personal data is collected through electronic means (e-mail, website, mobile app, AWS cloud storage) or physical environments. The legal bases for processing are:

• Art. 5/2-c: Necessary for the establishment or performance of a contract.
• Art. 5/2-ç: Necessary for compliance with a legal obligation.
• Art. 5/2-f: Necessary for the legitimate interests of the data controller, provided it does not harm fundamental rights and freedoms.

ARTICLE 7: YOUR RIGHTS

Pursuant to Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed.
• Request information if it has been processed.
• Learn the purpose of processing and whether data is used accordingly.
• Know the third parties to whom data is transferred (domestic or abroad).
• Request correction of incomplete or inaccurate data.
• Request the deletion or destruction of data.
• Object to results arising exclusively from automated analysis.
• Claim compensation for damages arising from unlawful processing.

You may exercise these rights via the contact channels specified in Article 1.

Best Regards,
GSI GENERAL SURVEY GÖZETME A.Ş.