Home
About Us
Our Services
Legislation
- Legislation Categories
  Legislative Updates
  Here you can access most recent articles on legislative updates regarding Personal Data Protection Law, Social Security Law, Taxation Law, Occupational Health and Safety Law, Code of Obligations, Labor Law, Turkish Commercial Code, Law on Protection of the Value of Turkish Currency, Foreign Exchange Legislation, and Immigration Law in Turkey.
  Bilateral Treaties
  You can access the dates of the most recent international bilateral social security and double taxation treaties made between Turkey and other countries and relevant documents here.
Media Center
Tools
- Gross to Net Salary Calculate
- Net to Gross Salary Calculate
Contact

Details to Consider to Have a
Better Understanding of Your Payroll

In order to make payroll calculation; calculate the payroll from gross to net and net to gross in Turkey,
this complex algorithm has to be interpreted correctly.

The Basic Payroll Calculation

A= Total Gross Payments (Gross Salary + Additional Gross Payments)

B= SSI Employee Premium [(A – Applicable Exemptions) x SSI Employer Premium Rate]

C= Income Tax [((A - B – Applicable Exemptions) x Income Tax Rate*) - Minimum Subsistence Allowance]

*Income Tax Rate is applied at a progressive rate conforming to the cumulative income base.

D= Stamp Tax (A x %0,759)

Net Salary (To be paid to the Employee) = A - B - C - D

Total Employer Cost

Total Gross Payment + Social Security Employer Premium

Salary Concept in Turkey

Basic Salary

Salary is a benefit that can be represented, is provided with money, and in-kind benefits given to the employee in return for her/his service working at a specific workplace for an employer. Whether or not the salaries can be paid without being subject to social security premiums or income taxes from payments made under any name is a subject which is a confusing for foreigners in general about Turkey’s legislation. Apart from certain exceptions, it is generally essential to deduct social security (SSI) premium and income tax from in-kind or cash payments. While the social security premium withheld has a ceiling, the income tax is applied progressively, and is calculated by considering the cumulative income.

Gross Salary Concept: In Turkish Labor Law, the definition of gross salary is the salary earned by employees. However, this amount is not fully received by the employees due to the state's compulsory deductions based on the social security and tax liabilities of the employees. These deductions are applied over the gross salary and paid to the relevant authorities by the employers on behalf of the employees. Although employees are actually responsible for the payments to be made for these items subject to deductions, a deduction is made at a resource mediated by the employers to facilitate the payment and collection of these amounts for the employers and government. These deductions include income and stamp taxes, SSI employee premium, and unemployment insurance.

Gross Salary = Net Salary + SSI Employer Premium + Unemployment Insurance (Employee Contribution) + Income Tax + Stamp Tax

Net Salary Concept: The net salary represents the amount of gross salary remaining after deductions and the total amount received by the employee.

Net Salary = Gross Salary – SSI Employee Premium – Income Tax – Stamp Tax – Unemployment Insurance (Employer Contribution)

Total Employer Cost = Gross Salary + SSI Employer Premium + Unemployment Insurance (Employer Contribution)

The total employer cost of the employee is higher than the gross salary since the employer is obliged to apply deductions for the SSI employer premium and unemployment insurance items. In short, this difference arises from the employer contribution of the specified deductions.

Payment in Different Ways

That the payment of the salary is performed as allowance, compensation, cash indemnity (financial liability indemnity), fund, raise, down payment, due, attendance fee, premium, bonus, reimbursement or under any other names; or assessing the payment in the form of a certain percentage of the earning if it is not of a partnership nature, shall not change its nature.

Payment Conditions of the Salary

The salary is paid in money to the employee's bank account. It cannot be paid as bond, property, or in any other similar means. If it is determined in foreign currency type, it can be paid in Turkish currency according to the foreign exchange buying rate of the payment day. The period of payment can be arranged at least as once a week and at most once a month. The limitation period for salary receivables is five years.

Reserved Part of the Salary

More than ¼ of the monthly salaries of the employees is non-seizable and cannot be conveyed or alienated to another person. Execution deductions must be deposited into the relevant executive office account within 7 days of the salary payment date unless otherwise specified. There is no limitation for alimony debt determined by the discretion of judges regarding dependent family members.

Payment in Foreign Currency

Premiums and Social Security System in Turkey

Social Security System and Premiums in General

Social security laws in Turkey aims to assure individuals in terms of health care and retirement. The conditions to benefit from these rights are set forth in relevant laws and regulations. Pension rights are earned with different premium systems and conditions with changing laws and practices accordingly. Eligibility of the retirement differs as per the premium payment days in terms of the service period, starting date, age, and gender. The continuity of the premium paid is one of the important conditions to benefit from the opportunities related to the public health service.

Social Security Institution (SSI) Premium Deductions

The social security deduction is calculated over the total gross salary by considering certain exceptions.

SSI Premium Distributions

Regular Employee

Long Term	Old Age, Disability and Death	9	11
Short Term	Occupational Accident (work injury), Occupational Disease, Old Age and Death	0	2
Short Term	General Health Insurance	5	7,5
Long Term	Unemployment Insurance Premium	1	2

Retired Employee

Long Term	Old Age, Disability and Death	7,5	22,5
Short Term	Up to the Degree of Danger		2

While applying the Social Security Premium deduction, the gross salary is taken as a basis and the total amount of this deduction, which corresponds to 34,5% of the gross salary, consists of the employee and employer contributions. The employee and employer contributions, which are the components of the total SSI premium, are calculated as 14% and 20,5% of the gross salary respectively and are paid by the employer until the last day of the following month. The employer can benefit from the treasury discount applied at a rate of 5% over the employer contribution of the SSI premium, if all the employees are insured and the employee and employer make their SSI premium payments on time. It is necessary to compare the minimum and maximum based amounts determined by the government with the gross salary to determine the variable to be taken as basis in calculating the premium to be paid. If the gross salary is less than the minimum base amount, a minimum amount must be taken; and correspondingly, if the gross salary is above the maximum level, the maximum base amount must be considered in the calculation.

Social Security Premium (Employee Contribution) = 14% of Gross Salary
Social Security Premium (Employer Contribution) = 20,5% of Gross Salary
Social Security Premium (Total) = 34,5% of Gross Salary

SSI premium rates are applied differently for people working in the status of retired.

Social Security Premium (Employee Contribution) = 7,5% of Gross Salary
Social Security Premium (Employer Contribution) = 24,5% of Gross Salary
Social Security Premium (Total) = 32% of Gross Salary

SSI Exemption

The Social Security Law provides some exemptions to specific allowances and compensation payments to reduce the employer’s cost that arises from the SSI premium calculations. The premium deduction made from these payments is reflected on the payroll with different calculation rules.

For example, these exceptions are applied at certain rates in the following situations:

Cash meal allowance, a percentage of the daily minimum salary for each day,
Child allowance, percentage of the minimum salary for up to two children,
Benefits In-kind (within certain rules),
Death, maternity, and marriage allowances,
Duty and business travel allowances, mobile duty compensation,
Severance payment, termination compensation, or lump sum payment in the form of severance payment,
Investigation fees (for legal issues), notice and cash indemnity compensation,
Private pension (BES) contributions and private health insurance paid by the employer to private health insurances and private pension system for the employee the monthly total of which does not exceed 30% of the minimum salary.

What is the Transferred SSI?

Unemployment Insurance

Unemployment insurance is based on the gross salary. The employee and employer contribution of the deduction corresponding to respectively 1% and 2% of the gross salary represent the total unemployment insurance and consists of 3% of the gross salary. The employer is obliged to pay the SSI premium mentioned above along with the unemployment insurance deduction on the last day of the following month at the latest. The method of calculating unemployment insurance deduction is the same as the method used in SSI premium calculation.

Unemployment Insurance (Employee Contribution) =1% of Gross Salary
Unemployment Insurance (Employer Contribution) = 2% of Gross Salary
Unemployment Insurance (Total) = 3% of Gross Salary

The unemployment premium is not calculated for retired employees.

Income Tax Deducted from Employees in Turkey

Income tax is applied to the financial income of business organizations and individuals and is collected on the salary income in the case of being an employee. For this tax, employers are obliged to apply deductions to the remaining part of the gross salary after deducting the SSI Premium and Unemployment Insurance deductions that are not subject to income tax and pay this amount to the tax office on behalf of the employee until the 26th of the following month.

The salary income in Turkey is a valid progressive taxation system through the cumulative income. The tax base is calculated as follows.

Income Tax Base = Gross Salary – SSI Employee Premium – Unemployment Insurance (Employee Contribution)

According to the tax table of the Turkish Revenue Administration, the income tax rate varies according to the determined cumulative income brackets. The cumulative income tax base is monitored annually and reset at the beginning of each year.

According to the table, if the income level reaches a higher level, a standard tax is collected for the part of the income up to the upper limit of the previous level, and a different tax rate is applied for the remaining part. The highest rate subject to income tax application is 40%. The amount of income tax is calculated as follows.

Income Tax Amount = Income Tax Base x Income Tax Rate (%)

Income Tax Exemptions

It is aimed to increase the net salary obtained through various exemptions in paying the income tax of the personnel. Here, we are going to elaborate some items that provide deductions from income tax. Income tax deductions require extensive knowledge and mastery of complex calculation rules.

Exemption for benefits ensured by providing meal in workplace premises or places other than the workplace (part of the daily wage according to the amount announced each year),
Child allowance (by age range),
Marriage and maternity allowance,
Private pension system and various private insurances,
Discounts based on the degree of disability.

Minimum Subsistence Allowance

It is a deduction mechanism calculated by the marital status and the number of children of the employee and deducted from the income tax. For the married employees, whether the spouse works or not and the ages of the children affect the calculations.

Private Pension System in Turkey (BES)

What is BES?

Private Pension System (shortly “BES” with the Turkish abbreviation) is a private pension system that facilitates employees to earn an income that they can maintain their living standards during retirement by directing their savings accumulated during their active working lives into long-term investments. Employees voluntarily participate in this system and create an additional income to the retirement income provided by the social security system.

The Difference Between Social Security and BES

BES, which entered into force in accordance with the Private Pension Savings and Investment System Law No. 4632, is based on collecting and evaluating savings and paying lump sum or salary to the person. This system does not provide health services or other services available in the Social Security Institution. BES is not an alternative, but a complement to the compulsory social security system.

Employer Contributed BES

Individuals can directly participate in the system on their behalf, and their employers can also add their employees to the system through a group pension contract. Employers who conclude a group pension contract can directly write an expense for the contributions they have paid on behalf of their employees (such that they cannot exceed 15% of the salary earned in the month of payment and the annual minimum salary annually). Benefits provided by the employer can be implemented in several ways.

Mandatory Pension Program

In accordance with the provisions of the Private Pension Savings and Investment System Law No.4632 on mandatory pension program that entered into force on January 1, 2017, employers are obliged to include their employees in the Mandatory Pension Program (shortly “OKS” with the Turkish abbreviation) under certain conditions. In this context, for the private sector, employers transfer at least 3% of their employees' earnings based on premium and for public institutions, they transfer at least 3% of the monthly wage based on pension premium to the system by making the deduction on the employee's payroll. Employees have the right to stay in this system as long as they wish.

Stamp Tax

Stamp Tax in Turkey is regulated by Law No. 488. The responsible persons (taxpayers) of the stamp tax are the persons who sign the papers with a certain price. In other words, the parties signing the contract are responsible for the calculation and payment of the stamp tax. As stipulated in the Law; salary, wage, daily pays, attendance fees, dues, specialist pays, bonus, meal and rental allowance, subsistence, compensations, and any similar money received in return for service (including down payments), fall into the scope of stamp tax.

Stamp tax is calculated over the total of gross payments and deducted from this amount. The rate applied for the stamp tax is 0,759% (7,59 per thousand).

Stamp Tax = Total of Gross Salary x Stamp Tax Rate (0,759%)

For example, if the gross salary is TRY 5.000,00 and the gross of an additional payment made in that month is TRY 2.500,00, the stamp tax is calculated as below.

[(5.000,00 + 2.500,00) * 7,59] / 1000 = 56,925 TRY

The stamp tax deducted from the employee is paid by the employer to the tax office with declaration.

Other than salary payments, stamp taxes are applied at different rates depending on the nature of the transaction. For example, apart from the stamp tax calculated on the salary, a separate declaration stamp tax (fixed amount) is paid when the taxes to be paid are declared. If any commercial contract involves an amount, a stamp tax will be paid over this contract by calculating at current rates. Similarly, stamp tax is calculated in rental contracts, as well.

Notification!

Contents provided in this article serve to informative purpose only. The article is confidential and property of CottGroup^® and all of its affiliated legal entities. Quoting any of the contents without credit being given to the source is strictly prohibited. Regardless of having all the precautions and importance put in the preparation of this article, CottGroup^® and its member companies cannot be held liable of the application or interpretation of the information provided. It is strictly advised to consult a professional for the application of the above-mentioned subject.

Please consult your client representative if you are a customer of CottGroup^® or consult a relevant party or an expert prior to taking any action in regards to the above content.

Let's Get Started.
Get a Quote for Your Service Needs.

CottGroup^® companies network ("CottGroup^®") includes independent companies with separate legal entities that provide various sections of this website and other websites in the CottGroup^® member network; and this Personal Data Protection and Processing Policy applies separately for each CottGroup^® member company.

This website you visited is affiliated with Boss Yönetişim Hizmetleri A.Ş. one of the CottGroup^® member network companies.

Thank you for visiting our web site and reading our privacy and security statement.

Basic Information About Our Approach To Data Security And Privacy

CottGroup^®’s network of companies (CottGroup^®) has dedicated itself to ensuring the security of your personal data in all of its information systems. For CottGroup^®, privacy and security matters form the basis of the relation between us and our customers. CottGroup^® understands your particular concern about your confidentiality and security and place utmost importance on that matter.

CottGroup^® consists of multiple independent members which provide various sections of the websites in CottGroup^®’s network of members. Please click here to see our current member companies. New members to be added to the CottGroup^®’s network of members in future will also be viewable by clicking the same link.

Information that you will be disclosing when using this web site may also be controlled by any other firm among the members of CottGroup^®’s network in order to enable us to secure the control, inspection and security of the said data at the utmost level. Each independent member shall be legally liable for any data controlled and inspected by it.

CottGroup^® Privacy Statement is applicable to all data processed by CottGroup^®, including Personal Data collected or transmitted via our websites in CottGroup^®’s network, our software and self-service applications, mobile applications or social media accounts and other online or off-line channels.

Protection of Personal Data

CottGroup^® acts in the capacity of a data controller in line with KVKK no. 6698 and provisions of any other legislation applicable to the protection of personal data. Accordingly, personal data shall be processed only by CottGroup^® personnel authorized to implement any privacy and security policy as well as services falling within the scope of duty of CottGroup^®’s management office and the personnel named in the privacy and security authorization matrices, and those natural/legal persons authorized by CottGroup^® for such purpose by fulfilling the condition of informing the data subjects. For details, please click the Personal Data Protection and Processing Policy.

Electronic Messages

Subject to communication consents provided by you during your communication with us regarding electronic (e-mail) messages and through any other CottGroup^® channel, you will be deemed to have accepted to receive e-mail messages through your contact details, for the promotion of services offered by CottGroup^® and its business partners, information on new products and services, announcements on issues regarding legislation, and other matters that may be of interest for you. In this respect, you may contact CottGroup^® to request that messages are no longer sent to you through one or more than one communication channel.

Log Data, Cookies and Web Beacons

Cookies are program bits that are usually in the form of text files that may be embedded in laptops, desktop PCs and mobile devices, which collect various data.

Cookies may be used to collect the following data:

Internet Protocol (IP) address,
Domain name of the computer that you use for connecting to the website,
Date and time of your connection and the time you spend on the website.
Link of the page over which you connect our web site or the address of another CottGroup^® website
Information about your computer, your browser’s brand, your operating system, Java support, flash version, your screen definition and connection speed and similar data,
Details of the page on the computer that is used for connection when a request is made from our web site,
Volume of the data in bytes, transferred on our website,
Contents of traceable cookies,
CottGroup^® websites use temporary session cookies to render your online activities secure and to enhance the website performance;
Areas such as Login time, Username and User ID that are necessary for our software and self-service applications ("Applications");
Details of the URL over which the User has transmitted his last request through the Applications
Your browser’s language

Please click Cookie Policy for details.

Purpose of Using Your Data

We may use your personal data which we record during your visits to our website, via automated or non-automated means, or which you may disclose to us in communication forms, e-mails or via other electronic transactions, primarily for the purpose of satisfying your requests and subsequently for ensuring improvement of the services offered to you. Overall purposes of use of such data may be listed as follows:

To contact you,
To enable your access to the website or self-service options, by performing operations regarding your online account, including but not limited to the provision of a username and password,
To answer questions received from you,
To provide information about legislative changes and other important matters,
To ensure the administration of our website,
To improve our service quality.

Please do not disclose such data that you would not want us to collect for the purposes above. Please remember that unless you provide such data, we will be unable to contact you, and that your certain data may still be collected by means of cookies during your visit to this website.

Data Security

CottGroup^® places utmost importance on the security of your data. CottGroup^® places utmost importance on the security of your data. We take measures conforming to sector standards to prevent unauthorized collection and use of your data. Exchange of information on the İnternet is not generally secure. Therefore, we recommend you to exercise due care by user when exchanging information through our websites and online systems. If you don't take this care, CottGroup cannot guarantee you about security of your information and communication on the web-site or capture them by third parties.

When your information arrives at CottGroup^®, it is protected in accordance with our security and privacy standards. Your data are stored for the purposes set out above and only for the durations required by the needs of our business process or as prescribed by law.

Data Transfer

We may transfer the personal information we collect about you to other countries different from the country we collect the data, as we use their services of the internet service providers, hosting companies, e-mail providers, domain providers (for example: Microsoft 365). Data protection laws and regulations applied in these countries may differ from the laws applicable in Turkey.

Hereby, we will protect your information in accordance with the applicable law as described in this Privacy Policy while transferring to other countries.

Protection for Children’s Online Activities

We support parents willing to supervise and control online activities of their children. In no event do we ask children on purpose to share their personal data. If we come to know that a person whose personal data are collected by us is younger than 13 years old, we may use such data to try to promptly inform his/her parents. This rule shall be applicable for age 16 under the European Union General Data Protection Regulation (GDPR).

Designing New Processes in Line With Privacy Rules

CottGroup^® takes the most appropriate technological and organizational measures to ensure confidentiality when developing new systems and applies necessary developments for the processing of personal data in line with their intended purposes (Privacy by design).

Should you have any queries about this Privacy Policy, please click the link.

CottGroup^® website: https://www.cottgroup.com

Personal Data Protection Policy

1. Purpose and Scope

You may access our group companies within the CottGroup^® Member Companies Network via following link.

The website you visited is affiliated with Boss Yönetişim Hizmetleri A.Ş., one of the CottGroup^® member network companies.

The main objective of this Personal Data Protection Policy (the "Policy") is to provide explanations regarding the personal data processing activities carried out by the Company pursuant to the law and the systems adopted for the protection of personal data and, in this context, to provide transparency by informing the people whose personal data is being processed by our company.

This Policy applies to all activities managed by the Company regarding the processing and protection of personal data by the Company along with the relevant detailed data procedures.

2. Definitions

KVKK: Personal Data Protection Law numbered 6698

GDPR: EU General Data Protection Regulation

Data Processor: The natural person or legal entity that process data on behalf of the data controller with the authority given by the data controller

Data Controller: the one who defines the purpose and the means of processing personal data and responsible of the data recording system management

Data Subject: a natural person, includes but not limited to an employee, customer, business partners, stakeholders, authorities, leads, candidate for recruitment, intern, visitors, suppliers, employee of business partners, third parties of the Company and its affiliates with whom they have a commercial relationship, whose data is processed.

Explicit Consent: consent that is related to a specific issue based on information and expressed with free will.

Personal Data: any information related to a natural person whose identity is known or could be identified.

Sensitive Personal Data: Biometric and genetic information related with race, ethnicity, political or philosophical opinions, religion, sect or other believes, appearance, union memberships, health, sex life, convictions and security measures etc.

Processing of Personal Data: Any kind of operation performed on data such as obtaining, recording, storing, preservation, modification, reorganization, disclosure, transfer, takeover, making available, classification or preventing the use of personal data in fully or partially automated or non-automated ways, provided that it is part of any data recording system

Anonymization of Personal Data: to render data in such a way that it can no longer be associated with an identified or identifiable person even when the personal data is matched with other data.

Deleting Personal Data: to delete or to render personal data in such a way that it is no longer accessible or reusable for the users

Destroying Personal Data: rendering the personal data to make it inaccessible, unrecoverable and not useable by anyone

Company: Data controller CottGroup^® companies.

KVK Board: Turkish Personal Data Protection Board

KVK Authority: Turkish Personal Data Protection Authority

3. Policy

The Company has different policies that cover protection of personal data along with the information security as regards certain work activities and functions. Unless this Policy has additional provisions or higher standards for the protection of personal data, the other different data protection provisions of the company shall prevail.

The relevant regulation provisions shall be first to apply in processing and protecting personal data; and if there happens any contradiction between the articles of this Policy and the legislation, then current legislation clauses shall prevail.

Herein this Policy is prepared in accordance with the rules and procedures foreseen in KVKK and related law for the protection of personal data. In his context, as Data Controller is also liable to prevent illegal processing of personal data and access and protect the personal data from being accessed illegally in accordance with KVKK, he/she must take all necessary technical and administrative measures.

4. Principles To be Followed While Processing Data

Our Company acts in accordance with the following general principles in all of its Personal Data Processing activities:

Personal data must be processed lawfully, fairly and transparently,
Personal data can only be collected for specific, explicit and legitimate purposes,
Personal data must be adequate, relevant and limited to what is necessary for processing,
Personal data must be accurate and kept up to date with every effort to erase or rectify without delay,
Personal data must be kept in a form such that the data subject can be identified only if is necessary for processing,
Personal data must be processed in a manner that ensures the appropriate security,

5. Personal Data Collected

Your personal data collected by our company varies according to the quality of the relationship with our company and the legal obligations. Your personal data collected can be listed as follows:

Identity Information (liable to amendments as per to requirements, ID number, name, surname, passport number, if the ID card shared, the information on the card, photo, etc.)
Contact Information (E-mail address, phone number, mobile phone number, address etc.)
Client Information (client number, client income information, client profession information, vehicle registration plate, training information etc.)
Family members and Proximity Information (identification, contact information and professional, training information of the Data Holder’s children, spouses, in particular in relation to employee candidates, etc.)
Customer Transaction Information (CDR (call detail record), call center records, credit card balances and extracts, payment receipts, client bank orders, and relevant information taken under record in regards; these are directly related to natural persons and the orders)
Physical Security Information (enter-exit records, visit information, camera records etc.)
Process Security Information (website password and password information, etc.)
Risk Management Information (associated with Data Subject, address register system records, IP address tracking records etc.)
Financial Information (in case of legal follow-up, credit card debt, loan amount, loan payments, debt balance, receivable balance in line with the information by the authorities etc.) and accounting information with related records.
Employee Candidate Information (CV, interview notes, personality test results etc.)
Legal Procedures and Compliance Information (data on the documents such as court and administrative authority decisions etc.)
Audit and Inspection Information (Information on any record and transaction relating to the legal pursuit and our rights associated with the Data Subject)
Sensitive Personal Data (data on health, data on criminal convictions and security measures,)
Claim/Complaint Management Information (information and records about the demands and complaints made to our Company regarding our services related to the person etc.)
Reputation Management Information (information collected in order to protect the commercial reputation of our company etc.)
Audiovisual Data (photos, camera records, auditory recordings etc.)
The Personal Data types listed do not include all your processed data and personal data similar to the data listed by our company may be processed.

6. The Purposes of Processing Personal Data

Our company informs data subjects during obtaining personal data due to KVKK and related legislation. In this context, the Company makes a notification/information regarding the purpose of data processing, transfer of the data and to whom the data shall be transferred, the method of collecting personal data and the legal purpose of collecting personal data.

The purpose of processing personal data information varies according to the relationship between the company and personal data subject and legal nature of the business.

The purposes of processing personal data by the Company are as follows:

Within the scope of the company based commercial activities, planning and business development tasks, etc.

Realization of legally required transactions, performance of obligations,
Declarations made to official institutions,
Activities related to the establishment and execution of contracts
Managing, conducting, planning and improving client relations.
Activities for the realization of post-contract services
Monitoring, planning and execution of consultancy activities
Monitoring, planning and execution of financial and accounting activities
Planning and execution of information technologies and data security activities
Planning and execution of physical and electronic / network security activities

Increasing brand awareness;

Planning and execution of actions aimed at increasing the level of perception about corporate activities and brand
Planning, management and execution of organizations, meetings, invitations and events
Managing the client satisfaction processes during and/or following the completion of service offering processes
Activities for receiving, evaluating and finalizing demands and complaints,
Realization and follow-up of transactions and activities to fulfill the obligations arising from the contractual relationship

Within the scope of planning, execution and management of corporate relations;

Managing, conducting, planning and developing relations with suppliers / business partners
Building and conducting corporate managerial communication activities
Building and conducting external trainings

Within the scope of legal, technical and commercial security measures among parties in relation with the Company data is processed under;

Notifying the relevant authorities / institution and/or conducting responsibilities within the audit processes
Assuring security measures on physical and electronic environments for the parties the Company is involved with
Keeping records as per to commercial security measures and organizing, conducting and auditing these measures for the parties the Company is involved with
Assuring the applicable activities are being conducted in regard with data accuracy and making sure the data is up to date
Planning and/or conducting the Health & Safety processes
All guest entrances – exits are recorded within the legal requirements and applicable to the legislation

7. Methods of Processing Personal Data and Its Legal Ground

Personal data can be obtained/received by parties who are data subject and/or third parties who have explicit consent from the data subject.

The obtained personal data can be processed by collecting, saving, editing, configuring, storing, adapting, changing, using, transferring, deleting, destroying and anonymizing.

Personal Data may be processed by one or more of the above methods without the explicit consent of the data subject in the presence of one the legitimate reasons listed in Article 5 of KVKK:

Explicitly prescribed in laws and any relevant legislation.
Being legally mandatory for the person cannot grant consent due to physical incapability or legally forbidden to grant consent in regards with other’s living rights
Requirement on processing personal data of the parties subject to a contract / agreement, due to the execution of a contract / agreement.
Legally being mandatory for the data controller to fulfil the legal liability.
Publicized by the relevant person directly.
Legally being mandatory to be processed for a granted right to be conducted, used and/or protected
Processing personal data for legitimate purposes without contracting the basic rights and freedom of the relevant person.

8. Retention and Destruction of Personal Data

Our company takes into account the law and legislation that is in place during processing the personal data. Within this scope, the retention and period of limitations are taken into account on Personal Data Protection activities. In case the processing activity is disposed, and there is no further legal ground to store personal data, relevant data is to be deleted, destroyed and/or anonymized. The personal data shall be subject to retention, disposal or anonymization upon the demand of the data subject and/or the Company’s periodic control in which the Company realizes the reason to process the data is no longer available, due to the Article 7 of KVKK and other related legislation.
The personal data transmitted to us by mistake in any way or in cases where it is understood that the will of the data subject is not directed to give explicit consent, is immediately destroyed by our Company by methods in accordance with the Law.
Our company will not keep personal data for longer than necessary, in connection with the reason for the collection of the data, so as to allow identification of the data subject.
Our company can only store personal data longer than advised, in order to protect the rights and freedoms of the data subject in line with applying technical and organizational precautions only to serve public welfare, scientific or historic research or statistical research.
Including the retention period for each category of personal data and the legal obligations that the Company has to store data, the criteria used in identifying this period are specified in our Company's Personal Data Retention and Destruction Policy and will be applied in all cases.

9. Transfer of Personal Data

a. Local Transfers

Personal data is not transferred to any third party without an explicit consent, unless it is legally required due to KVKK, relevant legislation and cases where it is mandatory to be shared with the external parties due to administrative / juridical cases. However, as per to the Article 5 and Article 6 of KVKK, in case legal grounds are present and it is legally required, on third party transferred, consent / explicit consent will not be observed.

Our Company fulfills its obligation to inform the Data Subject regarding this transfer. Accordingly, the institutions, organizations and / or persons that can be transferred are listed below.

b. Transfers to Abroad

The Company may transfer the personal data abroad by obtaining explicit consent of the data subject along with taking appropriate and necessary security measures foreseen in KVKK and related legislation. For the situations in which the explicit consent of the data subject is not sought, it is considered whether the country that the data will be transferred, is in "adequate country" stature and has enough protection or not. If the Authority considers that the transferee country is not in adequate country statute, the Authority approval should be taken, and a data transfer protocol should be signed to guarantee enough protection.

c. Parties Conducting the Transfers

Within the scope of the Labor Law, Obligations Law, Income Tax Law and Procedures, Commercial Law , Private Employment Agencies and relevant legislations,

Related public institutions and organizations,
Competent authority,
Tax offices work place inspector, İşKur, regional labor and SGK can be share with administrative institutions and organizations.

Apart from these, our Company shall not disclose your personal data in accordance with Articles 8 and 9 of KVKK and take all security measures specified in the relevant legislation;

Cott Group Companies, (Here you can find current list of CottGroup^® Companies.)
To business partners, suppliers, business partners that we cooperate with at local and/or abroad,
Data can be transferred to externally supported law offices, courts and other official and judicial authorities upon request.

10. Measures Regarding the Provision of Data Security

Our company takes technical and administrative measures to prevent data breaches to ensure the security of personal data. In this context, our Company;

Administrative measures;

It conducts a risk audit to identify existing risks and threats.
Awareness studies for employees are conducted periodically.
There are personal data security policies and procedures.
It works to minimize personal data as much as possible by adopting the concept of data minimization.

Technically;

Ensuring cyber security,
Monitoring of personal data security,
Ensuring the security of environments containing personal data,
Storing personal data in secure areas and cloud computing systems,
Information technology systems procure, develop and maintain the necessary software and hardware measures, taking personal data in accordance with the conditions required by the law.

11. Data Protection Officer (DPO)

The Data Protection Officer have specific responsibilities in respect of procedures and is the first point of call for Employees/Staff seeking clarification on any aspect of data protection compliance.
Data Protection Officer, who Board of Directors considers to be suitably qualified and experienced, has been appointed to take responsibility for Company’s compliance with this policy on a day-to-day basis and, in particular, has direct liability for ensuring that Company complies with KVKK and GDPR, as the authorized person of the Company does in respect of data processing that takes place within their area of responsibility.

12. Data Inventory

CottGroup^® has established a data inventory as part of its approach to address risks and opportunities throughout its KVKK and GDPR compliance project.

CottGroup^®’s data inventory determines:

business processes that use personal data,
processed personal data,
processed sensitive personal data,
data subject,
collection method of personal data-source of personal data
purpose of processing personal data,
legal reason for processing personal data,
retention period of personal data
mediums where personal data stored
destruction methods of personal data,
any kind of data transfers,
recipients/recipient groups to whom personal data transferred,
method and purpose of transfer,
technical and administrative measures.

13. Rights of The Data Subject

Within the scope of Article 11 of KVKK the data subject has the following rights and if he/she wishes, he/she can use his/her rights by reaching the data controller in the methods determined by him/her:

To learn whether personal data is being processed,
To make requests regarding the nature of information held and to whom it has been disclosed,
To learn the processing purpose of personal data and whether it is used in accordance with this purpose,
To be informed about the third parties that the personal data is transferred in local or abroad and to make notification as regards the transactions made,
To demand correction for the personal data that is processed as deficient or incorrect and to notify third parties about this,
To demand deletion or annihilation of the personal data of which reason to process is no more available, even if the data is processed in accordance with the related law,
To object any result against the data subject,
To demand compensation in case of any damage caused by illegal processing of the personal data.

14. Exercises of Rights of Data Subject

In accordance with KVKK regulations; in cases you have inquiries on your rights, mentioned hereinbelow, by completing the Data Subject Application Form you can send it to the address; Astoria Towers Kempinski Residences Büyükdere Caddesi No:127 B Kule Kat:8 34394 Şişli-İstanbul/Türkiye along with ID verification documents either by hand or via postage services or by sending an email to This email address is being protected from spambots. You need JavaScript enabled to view it.. All queries will be answered within 30 days of receipt.

If the transaction requires an additional cost, the tariff set by KVKK will be charged.