Personal Data Processing Policy

Scope and application

This policy explains how ESG360 (“ESG360”, “we”) processes personal data in connection with its ESG advisory, assessment, reporting, climate, supply chain, sustainable finance, training and digital monitoring services, its business relationships and its website. ESG360 is based in Istanbul, Türkiye, and is a subsidiary of Global Alliance Register (“GAR”).

It applies to personal data of prospective and existing clients and their staff, people whose information appears in the records we review for a client (for example employees, suppliers, contractors, board members and project participants), training participants, partners, suppliers, job applicants, website visitors and other business contacts. Separate notices may apply to specific projects, entities or jurisdictions.

Roles and responsibilities

Depending on the situation, ESG360 acts as a controller (we decide why and how personal data is processed, for example for our own client relationships, billing, quality and website) or as a processor (we process personal data on a client’s instructions while carrying out an engagement, for example when we review a client’s workforce, supplier or site records).

Where an engagement involves accredited or authorised partners, for example for independent verification or assurance, each partner is responsible for its own processing and for the independent judgments it makes. ESG360 does not itself certify, accredit or provide assurance.

Personal data we process

• Identification and contact data: name, job title, employer, email address, telephone number, postal address.
• Professional data: role, qualifications, training attendance, responsibilities relevant to an engagement.
• Engagement data: enquiries, request-for-information submissions and their tracking reference, proposals, contracts, correspondence, deliverables, meeting notes.
• Client-provided project data: workforce, health and safety, supplier, governance, emissions and operational records that may identify individuals, provided to us for assessment, due diligence or reporting.
• Financial data: billing details, payment references and tax records.
• Technical data: IP address, browser and device information, security logs and website use data.
• Communications: emails, messages, complaints and feedback.

Where the data comes from

From you directly (forms, email, calls, meetings); from your employer or the organisation we work for; from suppliers, subcontractors and partners; from GAR and group companies; from regulators and public professional or corporate sources; and automatically through our website and information systems.

Purposes of processing

• Responding to enquiries and request-for-information submissions, and issuing tracking references and confirmations.
• Preparing proposals and delivering ESG strategy, assessment, due diligence, reporting, climate, supply chain, sustainable finance, training and digital monitoring services.
• Managing contracts, invoicing, supplier and partner relationships.
• Coordinating with accredited and authorised partners where independent verification, certification or assurance is needed.
• Quality control, record keeping, risk management, security and fraud prevention.
• Complying with legal, tax, regulatory and professional obligations, and establishing, exercising or defending legal claims.
• Sending service information and, where permitted, newsletters and event information that you have asked for.

Legal bases

Depending on the context we rely on: performance of a contract or steps taken at your request before a contract; compliance with a legal obligation; our legitimate interests in running and protecting our business, provided your rights are not overridden; the establishment, exercise or protection of a legal right; and your explicit consent where the law requires it (for example for certain cookies or marketing messages). Where we process data under Law No. 6698 on the Protection of Personal Data (“KVKK”), we rely on the processing conditions in Articles 5 and 6 of that law. Where EU or UK data protection law applies, we rely on Article 6 (and, where relevant, Article 9) of the GDPR or its UK equivalent. You may withdraw consent at any time for the future.

Project and client records

Records we receive from a client may contain personal data of that client’s staff, suppliers or stakeholders. We use them only for the agreed engagement, limit access to those who need it, ask clients to share only what is necessary and, where possible, to anonymise or aggregate it. Evidence, working papers and deliverables may be retained to show how conclusions were reached, to meet professional requirements, or because a client or partner needs to rely on them.

Special categories of data

We do not seek special categories of personal data (such as health, trade union membership or biometric data) unless an engagement genuinely requires it, for example health and safety incident records in a site assessment. Where such data is processed we apply additional safeguards and process it only on a lawful basis.

Sharing and disclosure

• Authorised ESG360 personnel and GAR group companies, on a need-to-know basis.
• Accredited and authorised partners, auditors, verifiers and consultants working with us on an engagement.
• Service providers: hosting, email and communications, security, newsletter delivery, accounting, legal and professional advisers.
• Public authorities, regulators and courts where required by law or to protect legal rights.
• A buyer or successor in a business reorganisation, under confidentiality.

Recipients receive only the information needed for their role and are bound by confidentiality, contractual or legal duties. We do not sell personal data.

International transfers

ESG360 is in Türkiye, and our group, partners and providers operate in other countries. Where personal data is transferred abroad, we do so in line with the requirements of KVKK (including Article 9) and, where applicable, the GDPR, using the safeguards the law recognises, such as adequacy decisions, standard contractual clauses, undertakings or your explicit consent where it is required and valid.

Retention and disposal

We keep personal data only as long as reasonably necessary for the purposes above and as required by law. Typical drivers are the length of the engagement and the related limitation periods, tax and accounting obligations, professional record-keeping needs and legal claims. Enquiry and request-for-information records are kept for a limited period after the last contact unless a business relationship follows. When data is no longer needed it is deleted, destroyed or anonymised.

Security and confidentiality

We apply technical and organisational measures appropriate to the risk, including access control based on role, authentication, encryption in transit where available, backups, monitoring and confidentiality undertakings for staff and providers. No system is completely secure, so we review our measures periodically and ask clients to avoid sending unnecessary personal data.

Your rights

Under KVKK Article 11 and, where applicable, the GDPR, you may ask us whether we process your personal data and for information about it; the purposes and whether they are met; the recipients in Türkiye or abroad; correction of incomplete or inaccurate data; deletion or destruction; notification of those actions to recipients; to object to results produced exclusively by automated analysis that is to your disadvantage; compensation for damage caused by unlawful processing; and, under the GDPR, restriction, portability and objection. You can withdraw consent at any time.

To exercise a right, contact us as set out below. We may need to verify your identity and will reply within the periods set by law (under KVKK, as soon as possible and in any case within thirty days). Rights may be limited where we must keep records by law or to defend legal claims.

Website, cookies and electronic communications

When you use our website we process technical data to operate and secure it. Optional cookies and similar technologies are used only with your consent, which you can manage through Cookie Preferences in the footer. See our Cookie Policy and Website Privacy Policy. You can unsubscribe from newsletters at any time.

Children

Our services are for organisations and adult professionals. We do not knowingly collect personal data of children through our general services.

Automated tools and AI

We may use automated and AI-assisted tools for administrative, analytical or drafting tasks. They support, and do not replace, the professional judgment of our people, and we do not take decisions with legal or similarly significant effects on individuals solely through automated means.

Complaints and supervisory authorities

Please raise concerns with us first. You also have the right to complain to the Turkish Personal Data Protection Board (KVKK) or, where the GDPR applies, to the supervisory authority in your country of residence, place of work or place of the alleged infringement.

Updates and contact

We may update this policy; the date at the top shows the current version. Related documents: Website Privacy Policy, Cookie Policy, General Terms & Conditions.

GAR GÖZETİM MÜH. BAĞ. DEN. BEL. MÜŞ. VE EĞT. LTD. ŞTİ. (ESG360)
19 Mayıs Mahallesi, S. Ercan Caddesi, Paşa Korusu No: 18, Apartment 6, Kazasker, Kadıköy, İstanbul, Türkiye
Telephone: +90 (216) 599 0127
Privacy and data requests: privacy@esg360.com.tr
Tax ID: 3890699972, Erenköy Tax Office, Istanbul, Türkiye
Enquiries and data requests: through our contact page or the request-for-information form, marked “Data request” where relevant.