Privacy Policy

Version: 1.1
Date of Amendment: 04.10.2026

1. Purpose and Scope

As Bend Yapı İnşaat Taahhüt Sanayi ve Ticaret Limited Şirketi (“Bend Yapı”, the “Company”), we attach importance to the protection of your personal data and private information. For this reason, our Company, in its capacity as Data Controller, makes every necessary effort and exercises all due care to ensure that your personal data are processed in accordance with the Personal Data Protection Law No. 6698 (the “KVK Law”), by being used, recorded, stored, updated, transferred and/or classified in connection with business purposes, within the framework described below.

In this context, our Company takes all technical and administrative measures aimed at ensuring an appropriate level of security in order to prevent the unlawful processing of your personal data, to prevent unlawful access to them and to ensure their preservation, in accordance with the Law and Regulations enacted to protect the fundamental rights and freedoms of persons, in particular the privacy of private life, and to protect personal data.

The target audience of this text is all natural persons whose personal data are processed on our websites and in our corporate processes, and our employees. This policy covers all personal data processed within the scope of Bend Yapı’s website, communication channels and corporate processes.

Our Websites: bendyapi.com.tr

Personal information processed on our Sites is processed in accordance with the legislation on the protection of personal data.

On the other hand, we give no guarantee regarding the data security and data protection practices and policies of third-party websites to which we provide links on our Sites. In this regard, we recommend that you separately review the data security and data protection policies of the relevant data controller.

2. Identity of the Data Controller

Bend Yapı (or the “Organization*) has the status of “Data Controller” vis-à-vis all natural persons with whom it comes into contact and whose personal data it processes while conducting its commercial activities, in particular employees, employee candidates, customers, suppliers, supplier employees and visitors, and is obliged to fulfill the obligations arising from the law. Bend Yapı fulfills these obligations through administrative measures taken by means of the compliance and control tools it has adopted and through technical measures at an appropriate and proportionate level.

Bend Yapı processes your personal data in its capacity as “Data Controller” as defined in Article 3 of the Personal Data Protection Law No. 6698, and its contact details are given below:

With regard to the personal data of visitors to its websites and users of the services it provides over the internet, Bend Yapı has the status of “Data Controller” vis-à-vis the relevant natural persons. As a data controller, Bend Yapı fulfills its obligations arising from the law and Board decisions by taking administrative measures and technical measures at an appropriate and proportionate level.

Our identification details as the “Data Controller” and the contact details through which you can reach us regarding personal data are as follows:

3. Basic Concepts

Explicit consent: Consent relating to a specific matter, based on information and expressed of free will

Anonymization: Rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even when matched with other data

Data subject: The natural person whose personal data are processed

Personal data: Any information relating to an identified or identifiable natural person

Employee handling personal data: Employees who, by virtue of their job description, process the personal data of data subjects on behalf of the organization

Processing of personal data: Any operation performed on data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partially automated means or by non-automated means provided that they form part of a data recording system

Committee: The internal Committee established within the organization in accordance with the “Directive on the Duties and Responsibilities of the KVK Committee”, whose duties include monitoring all personal data processes carried out by the organization, its units and employees, checking whether the policies are complied with, and conducting personal data processes on behalf of the organization

Board: Personal Data Protection Board

Authority: Personal Data Protection Authority

KVK: Personal Data Protection Law No. 6698

Special Categories of Personal Data: Data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data

Data processor: A natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller

Data recording system: A recording system in which personal data are structured and processed according to specific criteria

Data controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for establishing and managing the data recording system

Joint data controller: Another data controller with which the organization shares personal data within the scope of its commercial and corporate activities and with which it jointly carries out processing activities on the personal data during such sharing.

Independent data controller: Other independent data controllers that process personal data of the same persons within the scope of their commercial and corporate purposes

4. Purposes of Processing Personal Data

In our Organization, the personal data of data subjects are processed, entirely and directly in connection with the organization’s activities and its commercial, business or legal relationship with the data subject, for the following purposes;

• Purposes Related to Management Processes:
  1. Conducting commercial activities,
  2. Ensuring business continuity and legal and administrative business security,
  3. Planning and executing business and implementation strategies,
  4. Managing occupational health and safety processes,
  5. Making presentations, promotions and providing information about the organization and its services,
  6. Fulfilling obligations arising from legislation and contracts,
  7. Ensuring physical premises security within and around the organization,
  8. Obtaining legal support,
  9. Using electronic and other social media tools and printed, periodical and non-periodical publications,
  10. Establishing and maintaining communication with members of the press and press and media organizations,
  11. Informing the public about activities,
  12. Conducting business meetings in a timely and effective manner,
  13. Completing work in a timely and proper manner,
  14. Planning and conducting activities at local, national and international levels,
  15. Conducting relations with business partners and group companies in Türkiye and abroad,
  16. Conducting transactions related to intellectual and industrial property,
  17. Carrying out promotion, marketing and information activities about the organization and its services,
  18. Receiving notifications and feedback from customers and potential customers,
  19. Providing technical support to customers,
  20. Answering the questions of customers and potential customers
  21. Providing support for electronic invoicing services,
  22. Participating in events such as fairs and seminars,
• Purposes Related to Employees:
  1. Establishing and performing employees’ employment contracts,
  2. Delivering and implementing the services offered to employees,
  3. Providing socio-economic benefits to employees,
  4. Conducting processes related to domestic and international assignments, travel and accommodation,
  5. Planning and conducting human resources processes,
  6. Conducting recruitment, the employment relationship and performance evaluation processes,
  7. Creating personnel files and storing them in physical and electronic media,
  8. Tracking working hours,
  9. Conducting exit procedures and exit interviews,
  10. Conducting performance and audit activities,
• Purposes Related to Information Technology Processes:
  1. Establishing and updating the information and communication infrastructure,
  2. Managing the users of information technology tools and systems,
  3. Managing corporate e-mail accounts,
  4. Managing corporate social media accounts,
  5. Managing, auditing and closing the e-mail accounts of employees who leave,
  6. Managing, monitoring and auditing portable and/or desktop electronic devices,
  7. Conducting transactions related to website members,
  8. Ensuring data security and archiving data,
  9. Keeping internet access logs,
  10. Tracking the organization’s vehicles and their users,
  11. Protecting and managing customers’ digital assets and rights, for which purposes personal data are processed.

5. Data Subjects Whose Personal Data Are Processed

Bend Yapı generally and predominantly processes the data of data subjects within the scope of this Privacy Policy and other administrative and technical measures. The organization’s data processing policies, in particular this Privacy Policy, will also be complied with in the processing of personal data belonging to natural persons outside these categories. The categories of natural persons whose personal data are processed are as follows:

1. Employees,
2. Persons employed under an employment contract of indefinite duration,
3. Interns and persons participating in İŞKUR (Turkish Employment Agency) on-the-job training programs,
4. Job applicants,
5. Customer representatives and employees,
6. Supplier representatives and employees,
7. Consultants and Auditors,
8. Public officials,
9. Our visitors,
10. Visitors to the Websites,
11. Potential customers.

6. Legal Grounds and Categories of Personal Data Processed

6.1. Personal Data of Our Employees, Our Employees Serving Under Employment Contracts of Indefinite Duration and Interns

The Organization processes the personal data of employees, employee candidates and interns in accordance with

• the Employment Contract,
• Labor Law No. 4857,
• Turkish Code of Obligations No. 6098,
• Law No. 5510 on Social Insurance and General Health Insurance,
• Occupational Health and Safety Law No. 6331,
• Law No. 4632 on the Individual Pension Savings and Investment System,
• Enforcement and Bankruptcy Law No. 2004,
• Law No. 4904 on Certain Regulations Concerning the Turkish Employment Agency,
• Vocational Education Law No. 3308,
• Turkish Commercial Code No. 6102,
• Electronic Signature Law No. 5070,
• Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications,
• the Regulation on Social Insurance Procedures,
• Identity Notification Law No. 1774,
• the Regulation on the Payment of Wages, Premiums, Bonuses and All Similar Entitlements Through Banks

and similar laws, regulations and communiqués.

Within this scope, the Organization processes employees’ data in the categories of identity, contact, personnel, financial, professional experience, physical premises security, legal transactions, transaction security, risk management, visual and audio records and other information, as well as special categories of data such as belief, association membership, foundation membership, health information, criminal convictions and security measures.

6.2. Personal Data of Job Applicants

We process personal data such as identity, personnel, contact, family information, financial, education, professional experience and habits that job applicants share with us of their own accord through means such as résumés and cover letters, or that are shared with us by online employment platforms and/or talent agencies to which they have submitted such data of their own accord for sharing with all relevant organizations, as well as special categories of data, such as association and foundation memberships recorded in their résumés, that they likewise share of their own accord.

6.3. Personal Data of Natural Person Suppliers and Representatives of Corporate Suppliers

The Organization processes the personal data of natural person suppliers and representatives of corporate suppliers with whom it establishes relationships while conducting its commercial activities pursuant to

• the Service Agreement,
• Turkish Code of Obligations No. 6098,
• Enforcement and Bankruptcy Law No. 2004,
• Turkish Commercial Code No. 6102,
• Tax Procedure Law No. 213,
• the General Communiqués on the Tax Procedure Law

and similar laws, regulations and communiqués. The Organization processes the personal data of natural person customers and suppliers and their representatives in the categories of identity, contact, financial, legal transactions and other information.

6.4. Personal Data of Auditors, Consultants and Public Employees

The Organization processes the personal data of auditors, consultants and public employees who carry out control and audit duties, for the purpose of conducting its commercial and manufacturing activities and ensuring their sustainability and quality, in accordance with

• Turkish Commercial Code No. 6102,
• Customs Law No. 4458,
• Tax Procedure Law No. 213,
• Labor Law No. 4857,
• Law No. 4904 on Certain Regulations Concerning the Turkish Employment Agency,
• Law No. 5510 on Social Insurance and General Health Insurance,
• the General Communiqués on the Tax Procedure Law,

and similar laws, regulations and communiqués.

Within this scope, the Organization processes the personal data of auditors, consultants and public officials in the categories of identity, contact and personnel.

6.5. Personal Data of Natural Person Customers and Representatives of Corporate Customers

We process the personal data in the categories of identity, personnel, contact, customer transactions and financial of our natural person customers and the representatives of our corporate customers who receive our construction, engineering and contracting services.

6.6. Personal Data of Our Visitors

For the purpose of ensuring information technology and facility security, we process the personal data of visitors

• within the scope of Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications,

and on the basis of our legitimate interest.

Within this scope, visitors’ personal data in categories such as Identity, Transaction Security and Physical Premises Security are processed.

6.7. Personal Data of Site Visitors

On the basis of our legitimate interest, the personal data of visitors to our websites are processed through “cookies”. For more information about cookies, please review our “Cookie Policy”.

6.8. Personal Data of Our Potential Customers

Apart from advertisements on our Sites, we may inform our customers and potential customers about our services and projects via e-mail, social media or telephone by obtaining their consent. Our potential customers may request information from us through the forms on our website. Data subjects may object to such promotional, advertising and promotion communications at any time. In addition, data subjects who do not wish to receive such e-mails and SMS messages from us may block the messages, use the unsubscribe option or apply to us to request removal from the lists. We process information of our potential customers such as identity, contact, personnel, financial and customer transactions.

We also have a newsletter to inform those interested in our services and projects. Each newsletter contains a link through which you can cancel your subscription to our newsletter. Those who wish to cancel their subscription may also do so by notifying info@bendyapi.com.tr. Limited to this scope, we process the personal data of our potential customers in the categories of identity, personnel and contact.

7. Rights of the Data Subject

The Organization acknowledges that, under the Law, the data subject has the right to give approval before the data are processed and, after the data are processed, the right to determine the fate of his or her data.

In this sense, by applying to the Contact Person, data subjects may exercise the rights to:

• a) Learn whether personal data are processed,
• b) Request information in this regard if personal data have been processed,
• c) Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• d) Know the third parties to whom personal data are transferred in Türkiye or abroad,
• e) Request the rectification of personal data if they have been processed incompletely or inaccurately,
• f) Request the erasure or destruction of personal data within the framework of the conditions set forth in Article 7 of the Law,
• g) Request that the operations carried out pursuant to subparagraphs (e) and (f) be notified to the third parties to whom the personal data have been transferred,
• h) Object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by automated systems,
• i) Request compensation for damages if you suffer damage due to the unlawful processing of personal data.

However, persons have no rights with respect to anonymized data within the Company. Personal data may be shared with the relevant institutions and organizations as required by the business and contractual relationship, or where a legal authority is exercised by a judicial or public authority.

Requests concerning the rights listed are made by completing the organization’s Application Form in full and submitting it, bearing your wet signature, to the Contact Person by registered mail with return receipt, together with copies of your identity documents (for the identity card, a copy of the front side only). For the application process, you may review the Personal Data Applications Privacy Notice.

8. Basic Rules to Be Followed in Processing Personal Data

When processing the personal data of data subjects, Bend Yapı units and employees shall take care to observe the following basic rules, on which the Privacy Policy and other corporate policies are also built.

• Compliance with the law and the rules of good faith: The Organization checks and questions whether the conditions specified in the KVK, such as informing the data subject and, where necessary, obtaining the explicit consent of the data subject for the processing of the data, have been fulfilled for the personal data it collects itself or that are shared with it by other parties. It acts in accordance with the rules of good faith when informing data subjects, obtaining their explicit consent or responding to their applications for information.
• Being accurate and, where necessary, up to date: The Organization endeavors to ensure, to the extent its control mechanisms allow, that the personal data it processes and keeps in its databases contain accurate information. It takes care to keep the data up to date as far as possible. It encourages data sources to share accurate information and to make updates when changes occur. It takes care to check that the data are accurate and up to date at the collection stage.
• Processing for specific, explicit and legitimate purposes: The Organization processes personal data only for the specific, explicit and legitimate purposes set forth in this Privacy Policy.
• Being relevant, limited and proportionate to the purposes for which they are processed: The Organization takes care not to process personal data for any purpose other than within the limits of the purpose for which they are processed and, when such a need arises, to inform the data subject and, where necessary, obtain his or her explicit consent. It uses data only to the extent limited to the purpose for which they are processed and required by the service. It does not process, use or allow the use of data outside business purposes. When personal data need to be processed for another purpose, corrections are made to the relevant compliance tools and control tools under the supervision and with the approval of the Committee.
• Retention Limitation: The Organization takes care to retain personal data for as long as provided for in the relevant legislation or as necessary for the purpose for which they are processed. It retains personal data arising from contracts for as long as the dispute periods under the relevant Laws and the requirements of commercial and tax law. However, when these purposes cease to exist, the organization erases or anonymizes the personal data. How long data in each category will be retained is determined in the Personal Data Inventory.
• Data Minimization: The Organization, its units and employees take care to collect data in the categories relevant to the purpose, only in the amount required by the purpose of processing, outside the scope and periods made mandatory by laws and the relevant legislation, and to process them in their systems only for as long as necessary.
• Erasure and Destruction: The Organization retains the personal data it processes for periods limited to those provided for in the laws to which it is subject and the relevant sectoral legislation, such as social security, obligations, tax and commercial law, and/or for the periods required by the purpose of processing. Upon expiry of these periods, it erases, destroys or anonymizes the personal data whose periods have expired in accordance with the Personal Data Retention, Erasure, Destruction and Transfer Policy and with the permission and under the supervision of the Committee.
• Confidentiality and Data Security: Throughout all processes of processing, transferring and storing personal data within the Organization, care is taken to comply with general confidentiality rules and to ensure data security, and actions are taken in accordance with the policy documents and rules established for this purpose. Care is taken to ensure that the necessary administrative and technical measures are taken.

9. Transfer of Personal Data

In order to conduct its construction, engineering and commercial activities and to ensure the conduct of activities requiring expertise that it needs as an organization, Bend Yapı uses service and product suppliers in Türkiye and abroad, and may transfer personal data to these suppliers, business partners or competent institutions and organizations, which are considered “data processors”, “data controllers” or “joint data controllers” depending on their job descriptions, activities and the nature of the service they provide.

9.1. Matters to Be Observed in the Transfer of Personal Data

• During the sharing of personal data, the data transfer is secured by signing a data transfer agreement, letter of undertaking or similar documents with all parties to whom data are transferred.
• Each unit and employee must consider in advance the risks that the counterparty to whom personal data are transferred may create with respect to personal data, and must take care to prevent situations that would create risk.
• In the use of foreign-origin applications and services, care is taken to comply with the relevant legislation such as the KVK and the GDPR.
• During data transfers to parties and suppliers, it is mandatory to ensure that data security is maintained through appropriate and secure tools and channels, to monitor whether the natural persons to whom personal data are transferred have been authorized by the counterparty, and to take care that any copies and duplicates of personal data created for the purpose of transfer are deleted from all media as soon as their function ends.
• The Organization’s units and employees are obliged to monitor the sensitivity and practices of the parties and suppliers to whom they transfer data with respect to personal data, and to report situations that may pose a risk to their superiors in a timely manner. The Organization’s employees should request the necessary support from their superiors in a timely manner regarding situations and problems concerning personal data that they cannot resolve.

9.2. Cases in Which Personal Data Are Transferred and Parties to Which They Are Transferred

Personal data are shared for the purposes stated below with the parties likewise stated below:

1. In cases necessary for the planning and execution of the commercial activities carried out by the Organization, to private institutions and organizations such as group companies, business partners, affiliates, consulting firms and other service suppliers in Türkiye and abroad, and to public institutions and organizations,
2. To natural and legal persons providing services in these fields, and to the third parties they work with, for ensuring business continuity, ensuring legal, technical and commercial business security, and planning and executing human resources, occupational health and safety and emergency processes and strategies;
3. To persons with whom the Organization has signed contracts within the framework of the services it procures, and to the third parties they work with,
4. To suppliers providing external services for the services offered by the Organization or of a nature that provides socio-economic benefits to employees, and to the third parties they work with,
5. During recruitment and termination processes, to internal departments of the Organization, our group companies, and previous or subsequent employers,
6. In cases necessary for the Organization to fulfill its legal obligations, to our business partners, consulting firms, suppliers, private institutions and organizations, courts, public institutions and organizations and competent authorities,
7. To the relevant banks, for the payment and collection transactions and the performance of obligations necessary within the scope of the establishment and performance of contracts concluded by the Organization,
8. To insurance agencies and insurance companies, so that employees can benefit from insurance and similar rights
9. To law offices, accounting/certified public accountant (SMM) offices, attorneys and other consultants, for the purpose of obtaining legal and financial support within the scope of the establishment, exercise and protection of our Organization’s rights,
10. To service suppliers in Türkiye and abroad providing cloud services, for the infrastructure and services required for corporate electronic communication channels and for ensuring data security;
11. To foreign-origin platforms and applications from which we procure services in order to use online communication channels and tools such as instant messaging, file sharing, video conferencing and electronic mail,
12. To the supplier from which we procure services, for the provision and authorization of services such as electronic signatures and corporate telephone lines,
13. To supplier organizations providing services in these fields, for sending messages of support to employees on their special days, organizing events and rewarding successful employees, for the purposes of increasing employee motivation and strengthening team spirit,
14. To auditors and to domestic or foreign-origin audit organizations conducting audits, so that audits on quality, social and other matters undertaken by the Organization or carried out at the request of customers can be conducted,
15. To private and public institutions/organizations for the purpose of conducting legal and technical processes related to work and transactions subject to intellectual and industrial property, personal data are transferred.

9.3. Transfer of Personal Data Abroad

Bend Yapı shares personal data with service providers established abroad for the purposes of operating our website, developing services, conducting office work and operations, providing services to users and visitors, ensuring their satisfaction, meeting their expectations and establishing communication. Within this scope, personal data are shared

1. With US-based Whatsapp (Facebook) for instant messaging, and,
2. With US-based Zoom and Google for video conferencing,
3. With US-based Google and Wetransfer for file sharing,
4. With US-based Apple and Google for mobile operating systems and the services that come with them,
5. With US-based Facebook, Twitter, Instagram, Youtube and Google for social media services.

You can access each service provider’s own privacy policies through the following links:

1. Microsoft (https://privacy.microsoft.com/en-us/privacystatement)
2. Whatsapp (https://www.whatsapp.com/legal/client)
3. Google (https://policies.google.com/privacy?hl=en-US)
4. Wetransfer (https://wetransfer.com/legal/privacy)
5. Facebook (https://www.facebook.com/policy.php)
6. Twitter (https://twitter.com/en/privacy)
7. Instagram (https://help.instagram.com/519522125107875)
8. Linkedin (https://www.linkedin.com/legal/privacy-policy)
9. Cloudflare (https://www.cloudflare.com/privacypolicy/)

10. Audit, Applications and Data Breach Notifications

The Organization may have the necessary internal and external audits carried out regarding the protection of personal data.

Applications made by data subjects are answered by the Committee within 30 days at the latest, after obtaining the opinion of the relevant unit.

When the Organization is notified of any breach concerning personal data, a notification is made to the Personal Data Protection Board without delay and within 72 hours at the latest from the date on which the situation became known. It also informs the relevant parties and persons in the same manner.

11. Updates

This policy document is updated when the organization’s personal data processing conditions, tools, purposes and scope change, and when the parties with whom personal data are shared change. Updates made to each article are kept in a separate table.