Policies

We believe that human resources are our greatest power to achieve our strategic targets and, manage the growth under the ever-changing competition conditions. We believe that PEACE AT WORK created by respect, understanding, and environment of trust in the working life relationships affects the loyalty and professional success of our employees and, make great efforts to maintain it.

We aim to employ such human resources that are open to innovations and changes and, that are dynamic aiming to continuously improve themselves and, respecting ethical values, and we are committed to keeping the satisfaction and motivation of our employees at the highest levels through the Human Resources Management Processes.

With the awareness of social responsibility and, without making any discrimination of religion, language, race, gender, civil status, physical disability, region etc., during the selection of human resources needed by our group companies;

• We Recruit people among those who have such knowledge and skills that meet the requirements of the respective position,
• Have a great potential for improvement,
• Adopt and sustain the values of our company and, attach importance to ethical values,
• And are above 18 as per the Regulations on Heavy and Dangerous Works, considering the principle of equal opportunities.

In accordance with the globalization vision of our company that is continuously growing and improving, we give priority to our internal resources, i.e. existing employees in order to meet the requirements for human sources in vacant locations and positions.

We carry out an efficient Career Management through changes of positions vertically and horizontally due to training and competence management systems that are intended to increase the personal and professional competencies of our employees.

1. Section
   • Introduction

Protection of personal data is among the most important precedences of Epsan Plastik San. Tic. A.Ş. (“Epsan” or “Company”) and it decisively strives to comply with all the legislation in force in this regard. Within the framework of this Personal Data Protection and Processing Policy of Epsan Plastik Sanayi Ticaret Anonim Şirketi (“Policy”), the principles adopted in the conduct of personal data processing activities carried out by our Company and the basic principles adopted in terms of the compliance of our Company’s data processing activities with the regulations contained in the Personal Data Protection Law No. 6698 (“Law”) are explained, and thus, our Company ensures the necessary transparency by informing the data subjects.  Being fully aware of our responsibility in this context, your personal data is processed and protected within the scope of this Policy.

• Scope

This Policy applies to all personal data of persons other than the employees of our Company, which are processed by completely or partially automated or non-automated ways provided that they are part of any data recording system. Detailed information about said data subjects can be accessed from the document ANNEX 2 (“ANNEX 2- Data Subjects”) to this Policy.

The activities carried out by Epsan regarding the protection of the personal data of our employees are managed under Personal Data Protection and Processing Policy for Epsan Plastik Sanayi Ticaret Anonim Şirketi Employees, which is written in parallel with the principles in this Policy.

Details of the personal data processing activities carried out by our company for Epsan employee candidates or Epsan employees, can be accessed respectively from the Personal Data Protection and Processing Policy for Epsan Plastik San. Tic. A.Ş. Employee Candidates and the Personal Data Protection and Processing Policy for Epsan Plastik San. Tic. A.Ş. Employees at http://epsan.com.tr/kvkk/.

• Implementation of the Policy and Relevant Legislation

The relevant legal regulations in force regarding the processing and protection of personal data shall be implemented. If there is incompatibility between the legislation in force and the Policy, our Company agrees that the legislation in force shall be implemented. The policy regulates the rules set forth by the relevant legislation by materializing them within the scope of Company practices.

• Definitions and Abbreviations

• Policy Validity and Current Version

The date of publication and update of the policy is on the first page. You can access the latest version at http://www.epsan.com.tr.

2. SECTION – ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA

• Ensuring the Security of Personal Data

In accordance with Article 12 of the Law, our Company takes the necessary measures according to the nature of the data to be protected in order to prevent the unlawful disclosure, access, transfer or security deficiencies that may occur in other ways. In this context, our Company takes administrative measures, carries out audits or has audits carried out to ensure the necessary level of security in accordance with the guidelines published by the PDP Board.

• Protection of Special Categories of Personal Data

The law attributes special importance to a number of personal data due to the risk of causing victimization or discrimination of individuals when processed unlawfully. These are; data related to race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, and the biometric and genetic data.

Epsan acts responsibly in the protection of special categories of personal data, which is determined as “in special categories” by PDP Law and processed lawfully. In this context, the technical and administrative measures taken by Epsan for the protection of personal data are carefully applied in terms of special categories of personal data and necessary audits are carried out within Epsan.

Detailed information on the processing of special categories of personal data is provided in section 3.3 (“Processing of Special Categories of Personal Data”) of this Policy. .

• Increasing The Awareness of Business Units on The Protection and Processing of Personal Data and Auditing

Epsan provides the necessary trainings for business units to raise awareness to prevent unlawful processing of personal data, unlawful access to personal data and to ensure the retention of data.

In order for Epsan employees to be aware of the protection of personal data, the necessary systems are being established and consultants are being worked with if needed regarding this issue. In this direction, our Company evaluates the participation in the relevant trainings, seminars and information sessions and updates and renews the trainings in parallel with the updates in the relevant legislation.

3. SECTION – ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA

• Processing of Personal Data in Accordance with the Principles Stipulated in the Legislation

3.1.1. Processing In Accordance With the Law and With Good Faith

Epsan acts in accordance with the principles introduced by legal regulations and with good faith in the processing of personal data. Within this framework, personal data is processed to the extent required by Epsan’s business activities and limited thereto.

3.1.2. Ensuring That Personal Data Is Accurate and Up to Date When Necessary

Epsan takes the necessary measures to ensure that the personal data is accurate and up to date during the processing period and establishes the necessary mechanisms for certain periods to ensure the accuracy and up-to-dateness of the personal data.

3.1.3. Processing For Specific, Explicit and Legitimate Purposes

Epsan clearly reveals the purposes of processing personal data and processes them within the scope of the purposes related to these activities in line with its business activities.

3.1.4. Being Relevant with, Limited to and Proportionate to the Purposes For Which They Are Processed

Epsan collects personal data only in the nature and to the extent required by its business activities and processes it limited to the determined purposes.

3.1.5. Retaining For the Period Stipulated by Relevant Legislation or the Purpose for Which They Are Processed

Epsan keeps personal data for the period required for the purpose for which they are processed and for the minimum period stipulated in the legal legislation to which the relevant activity is subject. In this context, Epsan first confirms whether a period of time is foreseen for the storage of personal data in the relevant legislation and if a period is determined acts in accordance with this period. If there is no legal period, personal data are stored for the period required for the purpose for which they are processed.  Personal data are destroyed at the end of the specified storage periods in accordance with the periodic destruction periods or the application of the data subject and with the determined destruction methods (deletion and/or destruction and/or anonymization).

3.2. Conditions For Processing Personal Data

Except for the explicit consent of the data subject, the basis of the personal data processing activity may be only one of the conditions specified below as well as more than one condition may be the basis of the same personal data processing activity. If the processed data is special category data, the conditions in title 3.3 (“Processing of Special Categories of Personal Data”) of this Policy shall apply.

One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the data subject should be declared related to a particular subject, on the basis of information and with free will.

In the presence of the following personal data processing conditions, personal data may be processed without the explicit consent of the data subject.

1. Explicit Stipulation in Law

If the personal data of the data subject is explicitly stipulated in the law, in other words, if there is an explicit provision in the relevant law regarding the processing of personal data, the existence of this data processing condition may be in question.

1. Failure to Obtain Explicit Consent of the Person Concerned Due to Physical Disability

The personal data of the data subject may be processed if it is mandatory to process the personal data of the person for the protection of the life or physical integrity of the person himself or of any other person, who is unable to express his/her consent due to physical disability or legal validity cannot granted for his/her consent.

iii. Directly Related to the Establishment or Performance of the Agreement

Provided that it is directly related to the establishment or performance of an agreement to which the data subject is a party, this condition may be deemed to have been fulfilled if the processing of personal data is necessary.

1. Fulfilling the Company’s Legal Obligation

The personal data of the data subject may be processed if processing is mandatory in order for our company to fulfill its legal obligations.

1. Data Subject’s Making His / Her Personal Data Public

If the data subject has made his/her personal data public, the relevant personal data may be processed for the purpose of making it public.

1. Data Processing Is Mandatory For the Establishment, Exercise or Protection of a Right

If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.

vii. Data Processing is Mandatory for the Legitimate Interest of our Company

The personal data of the data subject may be processed if it is mandatory for the legitimate interests of our Company to process data, provided that it does not harm the fundamental rights and freedoms of the data subject.

3.3. Processing of Special Categories of Personal Data

Special categories of personal data are processed by our Company in accordance with the principles set forth in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the PDP Board, and in the presence of the following conditions:

(i) Special categories of personal data except for health and sexual life, may be processed without seeking the explicit consent of the data subject if it is explicitly stipulated in the laws, in other words, if there is an explicit provision regarding the processing of personal data in the law to which the relevant activity is subject. Otherwise, the explicit consent of the data subject will be obtained in order to process the special categories of personal data.

(ii) Special categories of personal data concerning health and sexual life, may be processed, without seeking explicit consent, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing. Otherwise, the explicit consent of the data subject will be obtained in order to process the special categories of personal data.

3.4. Clarification of the Data Subject

Epsan makes clarifications to the data subjects in accordance with the article 10 of the PDP Law and the secondary legislation. In this context, as the data controller, Epsan informs the relevant persons about by whom, for what purposes the personal data is processed, for what purposes it is shared with whom, by what methods it is collected and legal reasons regarding thereof and the rights of the data subjects within the scope of the processing of their personal data.

3.5. Transfer of Personal Data

Our Company may transfer the personal data and special categories of personal data of the personal data subject to third parties (third party companies, official and private authorities, third real persons) by taking the necessary security measures in line with the personal data processing purposes in accordance with the law. Accordingly, our Company acts in accordance with the regulations stipulated in Article 8 of the PDP. Detailed information on this subject can be found in the document ANNEX 4 (“ANNEX 4- Third Parties to whom Personal Data is Transferred by our Company and the Purposes of Transfer”) to this Policy.

3.5.1 Transfer of Personal Data

Even if there is no explicit consent of the data subject, if one or more of the following conditions exist, the personal data may be transferred to third parties by taking the necessary care by our Company and taking all necessary security measures including the methods stipulated by the Board.

• The relevant activities related to the transfer of personal data are explicitly stipulated in the laws,
• The transfer of personal data by the Company is directly related to the establishment or performance of an agreement and is necessary,
• It is necessary for compliance with a legal obligation to which our Company is subject
• It is transferred by our Company in a limited manner for the purpose of making it public, provided that the personal data is made public by the data subject,
• The transfer of personal data by the Company is mandatory for the establishment, use or protection of the rights of the Company or the data subject or third parties,
• The transfer of personal data is mandatory for the legitimate interests of the Company provided that the personal data does not harm the fundamental rights and freedoms of the data subject,
• When it is inevitable to protect the life or bodily integrity of a person or someone else who is unable to give consent due to actual impossibility or whose consent is legally not valid.

In addition to the above, personal data may be transferred to foreign countries declared to have adequate protection by the PDP Board in the presence of any of the above conditions. In the absence of adequate protection, in line with the data transfer conditions stipulated in the legislation, it may be transferred to foreign countries where the data controllers in Turkey and the relevant foreign country have undertaken an adequate protection in writing and where the PDP Board has permission.

3.5.2 Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred by our Company in accordance with the principles set forth in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and in the presence of the following conditions:

(i) Special categories of personal data except for health and sexual life, may be transferred without seeking the explicit consent of the data subject if it is explicitly stipulated in the laws, in other words, if there is an explicit provision regarding the processing of personal data in the relevant law. Otherwise, explicit consent of the data subject will be obtained.

(ii) Special categories of personal data concerning health and sexual life, may be transferred, without seeking explicit consent, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing. Otherwise, explicit consent of the data subject will be obtained.

In addition to the above, personal data may be transferred to foreign countries declared to have adequate protection by the PDP Board in the presence of any of the above conditions. In case there is no adequate protection, it may be transferred to foreign countries where the Data Controller Undertaking Adequate Protection and the PDP Board have permission in line with the data transfer conditions stipulated in the legislation.

4. SECTION – CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND PURPOSES FOR PROCESSING

In accordance with Article 10 of the Law and secondary legislation, the relevant persons are informed and personal data are processed in accordance with the general principles specified in the Law, especially the principles specified in Article 4 of the Law on the processing of personal data, based on and limited to at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law, in line with the personal data processing purposes of our Company. Within the framework of the purposes and conditions specified in this Policy, detailed information about the categories of processed personal data and categories will be available in the document of ANNEX 3 (“ANNEX 3- Personal Data Categories”) to the Policy.

Detailed information on the purposes of processing said personal data is included in ANNEX 1 (“ANNEX 1- Purposes of Processing Personal Data”) to the Policy.

5. SECTION – STORAGE AND DESTRUCTION OF PERSONAL DATA

Epsan keeps personal data for the period required for the purpose for which they are processed and for the minimum period stipulated in the legal legislation to which the relevant activity is subject. In this context, our Company first confirms whether a period of time is foreseen for the storage of personal data in the relevant legislation and if a period is determined acts in accordance with this period. If there is no legal period, personal data are stored for the period required for the purpose for which they are processed. Personal data are destroyed at the end of the specified storage periods in accordance with the periodic destruction periods or the application of the data subject and with the determined destruction methods (deletion and/or destruction and/or anonymization).

6. SECTION – RIGHTS OF DATA SUBJECTS AND EXERCISE OF THESE RIGHTS

6.1. Data Subject’s Rights

Personal data subjects have the following rights:

(1) To learn whether the personal data are processed or not,

(2) To request information if the personal data are processed,

(3) To learn the purpose of the data processing and whether this data is used for intended purposes,

(4) To know the third parties to whom his/her personal data is transferred at home or abroad,

(5) To request correction of personal data in case of incomplete or incorrect processing and to request the notification of the transaction made within this scope to third persons to whom the personal data are transferred,

(6) To request the deletion or destruction of personal data in the event that the reasons requiring their processing are eliminated, and to request the notification of the transaction made within this scope to third persons to whom the personal data are transferred, although it was processed in accordance with the provisions of Law and other relevant laws,

(7) To object to the processing of his/her personal data, exclusively by automatic means, which leads to an unfavorable consequence for the person himself/herself,

(8) To request compensation for the damage arising from the unlawful processing of the personal data.

6.2. Data Subject’s Exercise of His/Her Rights

Data subjects will be able to submit their requests regarding their rights listed in section 6.1 (“Data Subject’s Rights”) to our Company through the methods determined by the PDP Board. In this direction, they can use the “Epsan Data Subject Application Form” which can be accessed at https://www.epsan.com.tr/…KVK-Basvuru-Formu.pdf.

6.3. Our Company’s Response to Applications

Our Company takes the necessary administrative and technical measures to finalize the applications to be made by the data subject in accordance with the PDP Law and secondary legislation.

In the event that the data subject duly submits his/her request regarding the rights specified in section 6.1 (“Data Subject’s Rights”) to our Company, our Company will finalize the relevant request free of charge as soon as possible and within 30 (thirty) days at the latest according to the nature of the request. But if the transaction necessitate a separate cost, the fee in the tariff determined by the Board may be charged.

7. SECTION – SPECIAL CASES IN WHICH PERSONAL DATA IS PROCESSED

7.1. Personal Data Processing Activities Carried Out When Entering the Building, Facility and Within the Building, Facility as well as Website Visitors

In order to ensure security by Epsan, personal data processing activities are carried out in Epsan buildings and facilities with security cameras for monitoring guest entrances and exits.

7.2. Camera Monitoring Activities Carried Out at the Entrances and Within Epsan Buildings, Facilities 

In order to ensure security in its buildings and facilities, Epsan carries out camera monitoring activities in accordance with the Law on Private Security Services and related legislation. In order to ensure security in its buildings and facilities, Epsan carries out security camera monitoring activities in accordance with the personal data processing conditions listed in the PDP Law for the purposes stipulated in the relevant legislation in force.

In accordance with Article 10 of the Law, Epsan makes clarification for the data subject with more than one method related to camera monitoring activities. In addition, in accordance with Article 4 of the PDP Law, Epsan processes personal data in a limited and measured manner in connection with the purpose for which they are processed.

The purpose of maintaining the video camera monitoring activity by Epsan is limited to the purposes listed in this Policy. In this direction, the monitoring areas and the number of the security cameras, and the period of monitoring is implemented adequately and to a limited extent in order to achieve the purpose of security. Monitoring is not carried out in areas that may result in interference (e.g. toilets) in a way that violate the privacy of the person or outside the security purposes.

Only a limited number of Epsan employees have access to live camera footage and recorded and stored in digital environment. A limited number of people who have access to the records declare that they will protect the confidentiality of the data they access with an undertaking of confidentiality.

7.3. Follow-up Carried Out at the Entrances and Within Epsan Buildings, Facilities 

Epsan carries out personal data processing activities for the purpose of ensuring security and monitoring guest entrances and exits in Epsan buildings and facilities for the purposes specified in this Policy.

The data subjects in question are clarified in this context when obtaining the names and surnames of the persons who visit Epsan buildings as guests or through the texts posted within Epsan or otherwise made available to the guests. Data obtained for the purpose of guest entrance-exit follow-up are processed only for this purpose and the relevant personal data are recorded in data recording system in physical environment.

ANNEX 1 – Purposes of Personal Data Processing

ANNEX 2 – Data Subjects

ANNEX 3 – Categories of Personal Data

ANNEX 4 – Third Parties to whom Personal Data is Transferred by Our Company and the Purposes of Transfer

In accordance with Articles 8 and 9 of the PDP Law, Epsan may transfer the personal data of the data subjects managed by this Policy to the following categories of persons:

(I) Epsan’s business partners,

(ii) Epsan’s suppliers,

(iii) Epsan’s companies,

(iv) Legally authorized public institutions and organizations

(v) Legally authorized private legal persons

The scope of the above-mentioned persons to whom the transfer is made and the purposes of data transfer are stated below.

As Epsan, we are dedicated to upholding our business ethics, legal obligations, and social responsibilities to actively combat bribery and corruption. With this policy, our objective is to encourage integrity, openness, and equitable conduct in the business’s interactions with its employees, suppliers, and other stakeholders. In that context, our anti-bribery and anti-corruption policy is founded on the following principles:

• In our business operations, we strictly prohibit the involvement in bribery, corruption, and any form of unfair gain.
• As a business, we consistently prioritize maintaining the highest standards of honesty, transparency, and ethical values.
• Every employee and all stakeholders are required to adhere to this policy and comply with the law.
• Our employees undergo regular training sessions on the guidelines outlined in this policy and the ethical values upheld by the business.
• Our employees have an obligation to report any instances of attempted bribery or corruption involving our customers, suppliers, or any other stakeholders.
• We routinely conduct internal audits to identify and address any unethical behavior.
• All stakeholders of the business, including suppliers and customers, pledge to adhere to the company’s zero-tolerance policy against bribery and corruption.

As Epsan, our policy governing activities throughout our entire supply chain is founded on the following principles:

• We advocate for the utilization of renewable and recyclable raw materials to mitigate environmental impacts.
• We actively seek solutions to diminish waste generation throughout the entire supply chain, aiming to minimize waste through recycling or reuse.
• We consistently monitor energy consumption and endorse energy efficiency initiatives among our suppliers.
• We strive to diminish the carbon footprint associated with production and transportation processes while advocating for the adoption of sustainable energy sources.
• We uphold employee rights, ensure secure working conditions, and implement fair wage policies. We anticipate that our suppliers adhere to a comparable policy.
• We demand that our suppliers comply with sustainability standards and we engage in collaborative efforts with them.
• We make decisions with a long-term perspective, integrating business sustainability considerations into our financial decisions.
• We diversify our supplier base to ensure business continuity and achieve a competitive advantage.
• We utilize financial resources efficiently and implement continuous improvement strategies to enhance efficiency.
• We consistently communicate our sustainability goals and progress to all stakeholders involved.
• We consistently review and enhance our policies and practices.