1. Identity of the Data Controller

“Gayrettepe, Yıldız Posta Cad. No:14 Emel Apt. 2/202 Beşiktaş/İstanbul” (Av. Mehmet ŞAHİN, VKN: 7930289436) (“GRC LEGAL” or “Office”), we show utmost sensitivity to the security of your personal data as the data controller. In this context, the personal data of all natural persons with whom we interact and who apply to work within our Company are processed and stored in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK” or “Law”), the secondary regulations (regulations, communiqués, etc.) enacted under the Law and the binding decisions of the Personal Data Protection Board, and this information text has been prepared for the purpose of informing you about your personal data processed.

  1. Categories and Types of Personal Data Processed

Identity Information

Name, surname, date of birth

Contact Details

Address, telephone number, e-mail address

Personal and Professional Experience

Educational background, work experience, wage expectation, military service, foreign language, attendance to courses and seminars, office equipment/computer programmes and software used, driving licence information if it is shared due to the nature of the job.Kişisel Verilerin Toplanma Yöntemi ve Temin Edildiği Faaliyet

Data Category

Procured Activity

Identity & Communication & Personnel & Professional Experience

Semi-automated method;

Through your CV uploaded to the Careers area on the GRC LEGAL website.

  1. Purposes and Legal Grounds for Processing Personal Data

Data Category

Processing Purposes

Legal Reason









Kimlik & İletişim

– Carrying out employee candidate application and advanced recruitment and interview processes,

– Carrying out the selection and placement processes of employee candidates,

– In case of a positive result of the application, you will be contacted again and your requests can be met,

– Updating the information communicated to us with the execution of human resources and business continuity activities,

– If the recruitment is not realised, your CV can be evaluated and contacted for suitable positions that may arise in the future.


PDPL m.5/2/c-d-f;

Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract, it is made public by the data subject himself/herself, and data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.




Personnel &

Professional Experience



– Determining your suitability for the job, including interview processes,

– Ensuring that human resources processes are planned, policies are developed and maintained,

– Execution of assignment processes and remuneration policy within the scope of remuneration expectation


In addition, the responsibility for informing your references about the personal data of your references that you will share with GRC LEGAL and obtaining their explicit consent, if necessary, belongs entirely to the employee candidate. It is essential that GRC LEGAL does not collect your data other than your personal data that will be sufficient to evaluate your suitability for the job and position. For this reason, we recommend that you do not share your personal data other than those mentioned above and those required for your suitability for the position, and especially your personal data of special nature (such as health information, membership of associations, foundations, trade unions, etc.) in the applications you will make to our Company and in the CVs you will share, without prejudice to the exception cases where explicit consent is obtained by you.

  1. Transfer of Personal Data and Purposes of Transfer

Transmission Channels

Transfer Objectives

Legal Reason

Public institutions and organisations and judicial authorities legally authorised to receive information

Legal reporting, carrying out regulatory and audit activities, handling complaints and legal processes

With reference to PDPL 8/2-a; It is mandatory for the data controller to fulfil its legal obligation.

  1. Related Person Rights

By contacting GRC LEGAL at any time; arising from Article 11 of the Law: a) b) to learn whether personal data has been processed, c) to learn the purpose of processing personal data and whether personal data is used in accordance with its purpose, ç) to know the third parties to whom personal data is transferred domestically or abroad, d) to request correction of personal data in case of incomplete or incorrect processing, e) to request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7. f) to request notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data are transferred, g) to object to the occurrence of a result against the person himself/herself by analysing the processed data exclusively through automated systems, ğ) In the event that personal data is damaged due to unlawful processing of personal data, you can request the compensation of the damage; you can request your rights.

You can submit your requests regarding your rights and the implementation of the Law by filling out the application form that you can obtain from us or by submitting the following minimum requirements; (i) You can submit your requests with wet signature “Gayrettepe, Yıldız Posta Cad. No:14 Emel Apt. 2/202 Beşiktaş/İstanbul” via notary public, by registered mail with return receipt requested at your discretion for ease of proof, or by your personal application, (ii) By sending an e-mail to kvkk@grc-legal.com using the e-mail address notified to the company by you and registered in the company system.

In the application that you have as a personal data owner and that you will make in order to exercise your rights mentioned above and that includes your explanations regarding the right you request to exercise; the matter you request must be clear and understandable, the subject you request must be related to your person or if you are acting on behalf of someone else, you will need to submit your special power of attorney certified by a notary public in this regard.

In accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller”, it is mandatory to include name-surname, signature, Turkish ID number (nationality, passport number or ID number, if any, for foreigners), residential or workplace address for notification, e-mail address, telephone and fax number, and the subject of the request in your applications. Applications that do not contain such elements will be rejected by GRC LEGAL or directed to valid application channels.

GRC LEGAL always reserves the right to make changes in this disclosure text for reasons arising from the Law, secondary regulations and Board decisions. The amendments to be made in the clarification text and the current text shall become effective immediately as of the date of notification to you.