Employee Candidate Privacy Notice (KVKK)

Data Controller

As “Bonair Havacılık Ticaret ve Sanayi A.Ş.” (hereinafter referred to as “Bonair Havacılık”), we attach the utmost importance to the security of your personal data. As a Company, we attach great importance to processing and storing all kinds of personal data belonging to all persons related to the Company — including those who benefit from our services — in accordance with the Law on the Protection of Personal Data No. 6698. By means of this Privacy Notice, you are informed about the purposes for which your personal data will be processed, to whom it will be transferred, our method of collecting personal data, the legal basis for processing this data, and the rights you have under the KVKK.

Your personal data may be obtained, recorded, stored and retained by our Company Bonair Havacılık in its capacity as “Data Controller”, in accordance with the definition of data processing in the KVKK, and may be transferred to third parties located in Türkiye and abroad in line with the procedures and principles set out in the KVKK and this Privacy Notice.

a. Personal Data Processed When Shared With Our Company as Data Controller or by Automated Methods

The following personal data of employee candidates is processed by our Company as Data Controller:

• Identity and Contact Information: Full name, date of birth, place of birth, address, e-mail address, home and telephone number, national ID number, marital status;
• Special Categories of Personal Data: If included in the CV, information about associations, foundations and memberships. (We do not need special-category personal data within our recruitment processes; if such data is present in your CV, please remove it before sharing your CV with us.)
• Professional Experience Data: Diploma grade and number, graduated school, graduation date, certificates held, foreign language proficiency, records regarding title, driving licence class;
• Personnel Data: Work experience, salary expectation;
• Visual and Audio Records: Photograph;
• Physical Premises Security: If you physically enter our office, the card number issued to you and your entry/exit time information;
• Other: Personal data stated by employee candidates in their CVs other than the above (such as hobby information, number of children, smoking information), any personal data such as word, excel and presentation files you attach to your CV, and personal data disclosed during interviews held if the application process proceeds positively.

One of the fundamental principles adopted by the Law on the Protection of Personal Data is that data is processed in a manner proportionate to the activity. In this respect, employee candidates are advised not to include personal data in their CVs that is not directly related to the position applied for.

For the personal data of the reference person(s) you state in your CV (name, surname, telephone, e-mail, etc.), it is the responsibility of the employee candidate who processes and transfers such personal data to us to inform the relevant person and obtain their explicit consent. If the employee candidate shares information belonging to third parties such as reference persons, trade secrets and/or confidential information belonging to legal entities — by creating a profile and CV and/or by any other means — such permissions are deemed to have been obtained by the employee candidate. Our Company reserves its legal rights against any administrative and/or criminal sanctions directed at it in this regard.

b. Purposes for Which Personal Data May Be Processed

Your personal data specified above is processed by our Company for the following purposes:

• Ensuring physical premises security, providing information to authorised persons, institutions and organisations, creating and tracking visitor records,
• Carrying out employee candidate / intern / student selection and placement processes, and carrying out employee candidate application processes,
• Carrying out activities in compliance with legislation,
• Planning of human resources processes, execution / supervision of business activities,
• Carrying out information security processes,
• Carrying out communication activities,
• Carrying out goods / service production and operation processes,
• Carrying out the remuneration policy.

c. Method and Legal Basis of Data Processing

Method of Processing: Your personal data is obtained, transferred to us and may be processed by us through any verbal, written or electronic means, by automated or non-automated methods, when you record your personal data within our Company’s job posting on our website, or when you hold an interview with our Company officials regarding the application process, or when you transmit your personal data physically or electronically.

Legal basis: Under the KVKK, the legal basis for our collection and processing of the personal data described above varies according to the personal data in question and our processing purpose. Your personal data will be processed for the data-processing purposes set out in this Privacy Notice based on the following legal grounds:

• It is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract,
• The data has been made public by the data subject,
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Special categories of personal data of our employee candidates may be processed in the other cases listed in Article 6 of the KVKK.

ç. Transfer of Processed Personal Data

In order to maintain its activities and business processes, our Company may share your personal data — within the framework of the personal-data-processing conditions set out in Articles 8 and 9 of Law No. 6698 and the purposes specified above — with our business partners located in Türkiye and/or abroad with whom we cooperate, our group companies, and our service providers from whom we receive support in areas such as storage, archiving and information-technology support (ERP, time-attendance systems, server, hosting, software, cloud computing, etc.) and who process personal data on our behalf in Türkiye and/or abroad.

d. Your Rights as a Data Subject

Regarding the processing of your personal data by our Company, pursuant to Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether it is used in accordance with that purpose,
• Know the third parties to whom your personal data is transferred at home or abroad,
• Request the correction of your personal data if it has been processed incompletely or inaccurately,
• Request the erasure or destruction of your personal data if the reasons requiring its processing no longer exist, and request that correction or erasure operations be notified to the third parties to whom the data has been transferred,
• Object to a result against you arising from the analysis of the processed data exclusively through automated systems,
• Request compensation if you suffer damage due to the unlawful processing of your personal data.

If You Wish to Contact Us for Your Requests

For written requests; you may deliver a wet-signed copy of the “KVKK Application Form” available on our website (https://bonair.com.tr/) in person together with an identity document, or by proxy with a notarised power of attorney showing that you are authorised to apply regarding the rights listed under Article 11, or send it via notary to the address “Şenlikköy Mah. Orman Sk. No:10, 34153 Bakırköy / İstanbul”.

For electronic requests; you may submit the KVKK Application Form by signing it with an electronic or mobile signature holding a “secure electronic signature” certificate as defined in the Electronic Signature Law No. 5070, to our Company’s Registered Electronic Mail (KEP) address bonair@hs02.kep.tr, or to kvkk@bonair.com.tr using the e-mail address you have previously notified to our Company and which is registered in our systems. Your requests submitted to our Company will be answered in writing or electronically as soon as possible and within thirty days at the latest, depending on the nature of your request.