FORD OTOMOTİV SANAYİ ANONİM ŞİRKETİ
INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA WITHIN THE SCOPE OF FOSN PORTAL ACCESS
(“Information Note”)

Ford Otomotiv Sanayi Anonim Şirketi (“Ford Otosan” or the “Company”) attributes great importance to the safe and transparent processing of your personal data in accordance with the law and good faith, and this Information Note is prepared for explaining how and for which purposes your personal data is processed and how you can manage your preferences/ rights in this regard.

 

Below, you may find the information regarding your rights, the processing and transferring purposes of your personal data by the data controller, Ford Otosan, in accordance with the Personal Data Protection Law No. 6698 ("Law") within the scope of the Ford Otosan Supplier Network (“FOSN”) and Electronic Direct Data Link (“E-DDL”) access services provided by Ford Otosan.

 

a)   Which personal data does our Company process and for which purposes?

Based on the Article 5 of the Law, your identity information (name-surname), your contact information (e-mail address, office and mobile phone number), your user information (username, GSDB code), and your system security information (IP number, log records) obtained through the FOSN Access Control Request Form, the Supplier Industry E-DDL and the Common Material Management System (“CMMS”) Access Control Request Form, are processed in a limited and measured manner, in connection with the processing purposes set out below and in accordance with the general principles set forth under Article 4 of the Law.

 

Performance of FOSN and EDDL user agreements and related supplier service agreements,

Sharing announcements with suppliers,

Accessing systems of different Ford Otosan suppliers, routing to all necessary supplier environments/systems,

Auditing the activities of suppliers and manufacturers within the scope of our contractual relationship, evaluating and reporting the audit findings,

Planning and execution of all business activities with suppliers and manufacturers,

Planning and execution of Ford Otosan's commercial and/or business strategies, execution, evaluation and reporting of risk analysis studies and internal audits,

Meeting, evaluating and reporting all kinds of supplier and manufacturer requests, complaints, questions and opinions, taking the necessary actions, and carrying on communications with you to this end,

Storage of the personal data collected regarding the above-mentioned activities within the scope of the execution of these operations,

Conducting information security processes in environments where personal data collected within the scope of the above-mentioned activities are stored,

Carrying out all the above-mentioned activities in accordance with the current legislation,

Providing information to legally authorized institutions and organizations conducting legal affairs and exercising our right of defense when necessary.

For the detailed information on the purposes of processing your personal data by our Company; you can access the Ford Otomotiv Sanayi Anonim Şirketi Protection and Processing of Personal Data Policy, which has been shared with the public at www.fordotosan.com.tr .

 

b)   To whom and which purposes will our Company transfer your personal data?

All personal data collected as mentioned under this Information Note can be transferred to the following persons and organizations within the framework of the personal data processing conditions specified in Articles 8 and 9 of the Law:

 

Your above mentioned personal data are transferred to cloud-based Microsoft Ireland Operations Limited operating abroad and stored within Microsoft Ireland Operations Limited for the purpose of carrying out storage activities for the above-mentioned activities and receiving technical infrastructure service.

Your above-mentioned personal data may be transferred to legally authorized individuals and organizations, including ministries, courts, enforcement offices, and legally authorized public institutions for the purposes of carrying out activities in accordance with the current legislation, informing legally authorized institutions and organizations, conducting legal affairs and exercising our right to defense when necessary.

c)   Which methods and legal reasons does our Company obtain your personal data?

All your personal data processed for the purposes mentioned above are obtained physically and/or electronically via (i) FOSN Access Control Request Form, (ii) Supplier Industry E-DDL and CMMS Access Control Request Form.

 

Personal data collected by our company for the purposes and methods mentioned above can be processed and transferred based on the following legal reasons within the scope of Article 5 of the Law:

 

Your personal data processed for the purpose of carrying out storage activities and obtaining technical infrastructure for above mentioned activities are transferred to and stored by cloud-based Microsoft Ireland Operations Limited operating in this fields and abroad, based on the legal ground of “our legitimate interest” within the scope of appropriate safeguards provided as per the Law.

Your above-mentioned personal data that are processed for the purpose of performance of FOSN and EDDL user agreements and related supplier service agreements, sharing announcements with suppliers, accessing systems of different Ford Otosan suppliers, routing to all necessary supplier environments/systems, auditing the activities of suppliers and manufacturers within the scope of our contractual relationship, evaluating and reporting the audit findings are processed and transferred to above-mentioned individuals and institutions based on the legal reasons of "establishment and performance of the contract" and " exercising, establishing or protecting a right " (FOSN and EDDL access rights)

Your above-mentioned personal data that are processed for the purpose of planning and executing the commercial and/or business strategies that Ford Otosan has established with its suppliers, meeting, evaluating and reporting all kinds of demands, complaints, questions and opinions of suppliers and manufacturers and taking all necessary actions to this end, and communicating with you, conducting risk analysis studies, internal audits, evaluation and reporting, and information security processes are processed and transferred to the above-mentioned individuals and organizations based on the legal reasons of "explicitly stated in the laws”, “fulfilling our legal obligations” and “existence of our legitimate interests”.

Your above-mentioned personal data that are processed for the purposes of carrying out activities in accordance with the current legislation, informing legally authorized institutions and organizations, conducting legal affairs and exercising our right to defense when necessary are processed and transferred to the above-mentioned individuals and organizations, based on the legal reasons of "exercising, establishing or protecting a right" and "fulfilling our legal obligations”

d)   Rights of the Data Subject under Article 11 of the Law

According to the Article 11 of the Law, data subjects are entitled to the following rights to;

 

Learn whether or not data relating to him/her are being processed;

Request further information if personal data relating to him/her have been processed;

Learn the purpose of the processing of personal data and whether or not data are being processed in compliance with such purpose;

Learn the third party recipients to whom the data are disclosed within the country or abroad,

Request rectification of the processed personal data which is incomplete or inaccurate and to request such process to be notified to third persons to whom personal data is transferred.

Request erasure or destruction of data in the event that the data is no longer necessary in relation to the purpose for which the personal data was collected, despite being processed in line with the Law no. 6698 and other applicable laws and to request such process to be notified to third persons to whom personal data is transferred.

Object to negative consequences about him/her that are concluded as a result of analysis of the processed personal data by solely automatic means,

Demand compensation for the damages he/she has suffered as a result of an unlawful processing operation.

 

As Data Subjects, you can notify your requests regarding your rights to Ford Otosan via the KVK Application Form shared with the public at www.fordotosan.com.tr .

 

Depending on the nature of the request, Ford Otosan will conclude the personal data requests free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the request requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged by Ford Otosan in accordance with the relevant legislation.