Privacy Notice on the Processing of Special Category Personal Data
Data Controller (Employer): your employer, acting as data controller
Data Processor: Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi (Rota)
Effective Date: July 10, 2026
This privacy notice is provided by your employer, acting as data controller ("Employer" / "Data Controller"), through the infrastructure of Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi (hereinafter "Luminis" / "Data Processor"), which operates the Rota platform as data processor, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (hereinafter the "Law"), in order to inform you about the special category personal data processed within the scope of the employment relationship between you and the Employer.
Definitions
- Personal Data: Any information relating to an identified or identifiable natural person.
- Special Category Personal Data: Personal data on race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data, as limited by law.
- Processing of Personal Data: Any operation performed on personal data, whether wholly or partly by automated means or otherwise, provided that it is part of a data recording system, such as collecting, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing its use.
- Explicit Consent: Consent given on a specific subject, based on information, and expressed with free will.
The Special Category Personal Data We Process
Within the scope of the employment relationship between you and the Employer, only the health documents that substantiate your leave and excuse processes are processed as special category personal data. These are documents you upload to the Rota platform as attachments to your leave request, such as illness/rest reports, incapacity reports, pregnancy check-up documents, and health documents substantiating companion (caregiver) leave.
Neither the Employer nor Luminis collects or stores in a structured form any special category personal data other than those listed above (for example, criminal records, blood type, disability status, chronic illness, substance/tobacco dependency, regularly used medication, or laboratory/physical examination results).
Legal Basis and Why Explicit Consent Is Not Required
The health documents referred to above are processed, pursuant to Article 6 of the Law, on the legal basis of being mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, and therefore without seeking your explicit consent. For this reason, this text is a privacy notice (information text) and not an explicit consent statement.
Should it become necessary to process any special category personal data that is required by the employment relationship but is not mandatory under a legal obligation, such processing will be carried out solely on the basis of your separate explicit consent, requested at the time of the relevant operation.
Transfer and Security of Data
Acting as data processor on behalf of the Employer (Data Controller), Luminis processes such data solely on the Employer's instructions and may transfer it to sub-processors (Supabase, Inc., Vercel, Inc., Expo / EAS) for technical services such as hosting, database, and application distribution. Luminis undertakes that there are confidentiality and data processing agreements with these sub-processors and that the necessary technical and administrative measures arising from the law have been taken.
Technical and administrative measures concerning your special category health data — such as access, retention, disposal, and encryption — are further regulated within the framework of the Employer's special category data processing protocol.
Your Rights
You may exercise the rights set out in Article 11 of the Law by applying to your Employer, which is the data controller. As an employee, you must direct requests regarding your personal data to your Employer, the data controller.
This document is provided for informational purposes only. The legally binding version is the Turkish original.