1. Purpose and Scope of the Clarification Text

Maslak Mah. Meydan Sok. No:1/55 Sarıyer İSTANBUL, registered with the Istanbul Trade Registry Directorate with the Registry Number 239434-5 and MERSIS Number 0649053919500012 and registered with the Maslak Tax Office with the Tax ID number 6490539195, Ottoo Yazılım A.Ş. ('Tutku.ai') attaches great importance to the processing and storage of your personal data in accordance with the Personal Data Protection Law No. 6698 ('Law') and we ensure the security of your personal data with great sensitivity.

In terms of the personal data we have processed within the scope of the Law, we are the 'data controller' to you, in other words, to the relevant persons whose personal data are processed. In this respect, with this clarification text, we would like to inform you, our personnel, about the collection and processing of personal data, our purposes, methods and your rights arising from the Law.

In accordance with the article titled 'Obligation of the Data Controller to Inform' in Article 10 of the Law, this clarification text has been prepared in order to inform you in the most transparent way about the identity of us as the data controller, the method and legal reason for collecting your personal data, the purpose for which this data will be processed, to whom and for what purpose it can be transferred, the duration of data processing and your rights listed in Article 11 of the Law. The explanations made for your personal data in the clarification text also cover your sensitive personal data.

Tutku.ai provides a SaaS (Software as a Service) product service that enables digital management of Human Resources processes with a modular structure and works with a B2B model. Within the scope of Tutku.ai's services; information about the population and information, address information, IBAN information, leave and expenditure information, salary information, seniority information, position information, etc. of the personnel of the companies registered in the system, and information about all human resources processes specified in Article 3 of this clarification text are personal data. For this reason, as Tutku.ai, we aim to inform you about how we process personal data due to the digital service of Human Resources processes offered to business owners within the scope specified in Article 10 of the Personal Data Protection Law No. 6698. We attach importance to the security and protection of the personal data you share with Tutku.ai. Tutku.ai is a 'Data Controller' as defined in the Law. In this context, we process your personal data in accordance with the Law and take appropriate, measured and adequate administrative and technical measures to protect your personal data. As a separate 'data controller', the member companies of the system, i.e. business owners, it is your responsibility to inform them that the data of other personal data owners such as your Employees, Suppliers, Customers whose data are processed by you are also processed by us. As a data controller, we fulfil our obligations arising from the law and Board decisions by taking administrative measures and technical measures at an appropriate and measured level.

2. Method and Legal Reason for Collecting Your Personal Data

Your personal data may be collected by means of computers and computer programmes, computer software and virtual storage areas, services with internet connection, forms and petitions stored in physical and digital media by automatic and non-automatic methods provided that they are part of the data recording system. Your personal data will be kept in physical and/or digital environment that can be created and updated and processed as long as your relationship with Tutku.ai continues. Your personal data listed below may be processed by Tutku.ai within the scope of paragraph 2 of Article 5 of the Law; 'a) It is explicitly stipulated in the laws, c) Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract': 

The purposes of processing your personal data are as follows:

• Execution / Supervision of Business Activities,

• To enable our relevant business units to carry out the necessary work so that real and/or legal third parties, institutions, and organisations (customers, employees, visitors, suppliers, business partners, etc.) who have a relationship with Tutku.ai can benefit from the products and services of our company and/or the centres and units affiliated to our company, 

• Execution of activities in accordance with the legislation,

• Execution of Business Continuity Ensuring Activities,

• Execution of Goods / Service Procurement Processes,

• Follow-up and Execution of Legal Affairs,

• Execution of Contract Processes,

• Execution of Finance, Human Resources Processes and Accounting Affairs,

• Informing the necessary persons and institutions,

• Carrying out auditing and/or regulatory duties to be carried out by the competent and authorised public institutions and organisations and professional organisations in the nature of public institutions,

• Fulfilment of information and document requests by judicial bodies and/or administrative authorities,

• Execution of Communication Activities,

• Fulfilment of labour contractual and legislative obligations for employees,

• Execution of fringe benefits and benefits processes for employees,

• Execution of Audit / Ethical Activities.

Your personal data may be processed primarily based on the condition of 'explicit consent' as specified in Article 5 of the Law. Also mentioned in the same article,

• 1. 'Explicitly provided for by law'

• 2. Fulfilment of the requirements of the contract to which you are a party, based on the legal ground 'conclusion or performance of the contract',

• 3. Fulfilment of legal obligations stipulated in the relevant legislation, such as responding to the requests of courts and public institutions and organisations requesting information-documents, based on the legal reason that the data controller can fulfil its legal obligation,

• 4. 'publicised by the person concerned',

• 5. Providing evidence in possible disputes, legal counselling and technical support based on the legal reason of 'establishment, use or protection of a right',

• 6. Data processing is mandatory for the 'legitimate interests' of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

It can be processed 'without seeking explicit consent' based on legal reasons. In this direction, we also process your personal data within the framework of the following legislation:

• 1- Article 5/a of the Law No. 6698 on the Protection of Personal Data (Explicitly stipulated in the laws)

• 2- Art. 5/c of the Law No. 6698 on the Protection of Personal Data (Being directly related to the establishment and performance of a contract)

• 3- Law No. 6698 on the Protection of Personal Data Art. 5/ç (Legal Obligation)

• 4- Article 5/e of the Law No. 6698 on the Protection of Personal Data (Establishment, Establishment and Protection of a Right)

• 5- Art. 5/f (Legitimate Interest) of the Law No. 6698 on the Protection of Personal Data

• 6- Turkish Commercial Code No. 6102

• 7- Turkish Code of Obligations No. 6098

• 8- Tax Procedure Law No. 213

• 9- Income Tax Law No. 193

• 10- Social Insurance and General Health Insurance Law No. 9783

• 11- Law No. 5549 on Prevention of Laundering Proceeds of Crime

3. Your Processed Personal Data

Personal data, as defined in Article 3 of the Law, is any information relating to an identified or identifiable natural person and constitutes the personal data mentioned in the content of this Clarification Text. Your personal data are processed securely in accordance with the Law in accordance with legal obligations or in order to ensure the company's business and transactions more legally and effectively.

In this context, the personal data processed within the scope of Tutku.ai's digital services are as follows:

• Population and Information: (This is the data group containing information about the identity of the person.) Signature, Name, Surname, Mother's name, Father's name, Identity Card serial number, Identity Card family sequence number, Identity Card sequence number, Identity Card volume number, Place of Registration, Gender, Date of Birth, Place of Birth, Marital Status, Identity Number, Passport Number, Motor Vehicle Driving Licence Information, Nationality.

• Contact: (It is the data group that can be used to reach the person.) Telephone Number, E-mail Address Residential Address, Information of the person to be called in case of emergency

• Finance: (This is the data group that can be used for the financial information of the person.) Bank Name, Bank Account Number, IBAN Number, Salary Information

• Customer Transaction: (This is the data group that can be used for information about the transactions of the person.) Cheque, Promissory Note Information, Order Request Information

• Criminal Convictions and Security Measures: It is the data group containing information about the criminal conviction and security measures of the person). Criminal Record

• Education: (This is the data group containing information about your educational status.) Graduation grade, Graduated school and department name, Transcript Information, Diploma, Graduation date, Education Status, On-the-Job Training, Certificate Information, Certificate Information, Foreign Language Information, Computer Usage Information, Course Information

• Audiovisual Records: (This is the category of data used for visual/auditory identification of the person.) Photograph

• Personnel: (Refers to the data types in the personnel personnel file.) Curriculum Vitae, SSI Service Transcript, Employment Contract Information, Leave Information, Social Security / Pension Information (SSI Entry), Payroll Information, Position,

• Physical Space Security This is the data category used to ensure physical space security). Camera recording (Image only)

• Legal Action: (Contains legal action information of the person.) Execution Files and Judicial Case Information

• Risk Management: (Refers to the risk management information of the person.) Risk Management Data

• Other: (It is the data group containing the data of the person in categories not listed in the Law). Personnel Clothing-Body Information, data related to Human Resources and other departments for the modules used in Tutku.ai, information on leave, expenditure, assigned fixtures, etc.

4. Transfer of Your Personal Data

By ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the Law and the relevant legislation, in line with the above-mentioned purposes;

• To legally authorised public institutions and organisations in line with the requests of the relevant public institutions and organisations and limited to the purposes of the request,

• Private insurance companies and banks for the fulfilment and continuity of financial services,

• Lawyers or law partnerships for the follow-up of legal affairs,

• To our direct/indirect domestic shareholders,

• To third-party software providers integrated with our platform (such as OpenAI databases, etc.),

• In order to carry out our activities, personal data may be transferred to domestic organisations that we contractually receive services and/or provide services, cooperate with, within the framework of the personal data processing conditions specified in Article 8 of the Law.

5. Data Processing and Storage Period

Your personal data, limited to the purposes specified in this Clarification Text; It will be processed by complying with the data processing and statute of limitations periods specified in all relevant laws and other legal legislation to which our company and our company's affiliated centres and units are subject. In case of changes in the laws regarding data processing periods, the new periods determined will be taken as basis.

Your personal data is stored on servers located in Germany (eu-central-1), on AWS S3.

As a requirement of the principle of purpose limitation, your personal data are processed limited to the time required for the fulfilment of the purposes described in this Clarification Text and in any case in accordance with the practices of the company and the customs of its commercial life, and after the expiration of the periods, they are deleted, destroyed or anonymised.

6. Rights of the Data Subject

You as data subjects pursuant to Article 11 of the Law,

• To learn whether personal data is being processed,

• Request information if personal data has been processed,

• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

• To know the third parties to whom personal data are transferred domestically or abroad,

• To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,

• Although it has been processed in accordance with the provisions of the Law and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,

• To object to the emergence of a result to the detriment of the person himself/herself by analysing the processed data exclusively through automated systems,

• In case of damage due to unlawful processing of personal data, you have the right to demand compensation for the damage.

You can always contact Tutku.ai management if you wish to exercise your rights in question.

Requests arising from the Law will be made through the 'PDPL Application Form'. In order to exercise your above-mentioned rights, you may submit your request containing the necessary information identifying your identity and your explanations regarding the right you request to exercise among the rights specified in Article 11 of the Law; by filling out the 'PDPL Application Form' on the web address tutku.ai and submit a signed copy of the form to Maslak Mah. Meydan Sok. No:1/55 Sarıyer İSTANBUL by hand or through a notary public or send it electronically to info@tutku.ai e-mail address or Tutku.ai's Registered Electronic Mail (KEP) address or send it by other methods to be stipulated by the Personal Data Protection Board in accordance with Article 13 of the Law.

In accordance with Article 13 of the Law, our Company will finalise the application requests free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the request is rejected, the reason(s) for rejection shall be justified in writing or electronically.

Contact information regarding Tutku.ai is presented to your attention at the end of this disclosure text. In this context, Tutku.ai will fulfil the relevant requests in case the personal data owner exercises his/her rights listed in Article 11 of the Law.

You can contact us via info@tutku.ai regarding your opinions, suggestions and requests.