ALT-SAYFA

OUR POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

The Personal Data Protection Law numbered 6698 (KVKK) regulates the procedures that those who are concerned shall comply with regarding the processing and protection of personal data, primarily for the purpose of protecting the privacy of private life and the fundamental rights and freedoms of individuals. Our company is fully aware of the procedures and responsibilities it has to comply with in accordance with the KVKK. The confidentiality and security of personal data remains of great importance for our company. One of our priorities is to fulfil the requirements to ensure compliance with the KVKK and to have a data protection and processing policy that fulfils international standards. Within this context, the basic principles and procedures which have been adopted for the protection and processing of personal data in accordance with the KVKK are determined in our ‘‘Policy on Protection and Processing of Personal Data’’ (‘‘KVK Policy’’) and implemented by our company in our company.

I. OUR GOAL:

Our goal is to take the necessary precautions to raise awareness about the protection of personal data within the structure of our Company, to establish procedures and to ensure compliance of internal operations of the Company with the KVKK. Our PDP Policy, which we have adopted, aims to guide our company, our company officials, our personnel, the persons we cooperate with and our visitors in terms of the implementation of the procedures and principles stipulated by the KVKK.

II. DETERMINATION OF RESPONSIBILITIES:

KVK officers from different departments of our company have been identified in order to ensure compliance with the KVKK and KVK Policy, to fulfil our obligations in this direction, to take necessary precautions, to implement instructions, procedures and training activities. KVK officers will be a source of consultancy and guidance in the implementation of KVKK and our KVK Policy. Whether the KVKK and our KVK Policy are complied with in all departments of our company is monitored and audited by KVK officers.

III. THE MAIN PRINCIPLES OF OUR KVK POLICY:

1. GENERAL PRINCIPLES:

The following general principles have been adopted for the processing of personal data in accordance with the KVKK:

a. TO CARRY OUT PERSONAL DATA PROCESSING ACTIVITIES IN ACCORDANCE WITH THE LAW AND GOOD FAITH:

Our company acts in compliance with the laws, secondary legislation, decisions of the KVK Board and the principles introduced by other legal regulations in the processing of personal data.
In accordance with the rules of good faith, personal data are processed limited to the purpose of processing and in the minimum amount possible according to the purpose. Furthermore, the reasonable expectations of the data owners are taken into account and the data owners are informed in advance about all transactions made regarding their data and, when necessary, the explicit consent of the data owners is obtained.

b. ENSURING THAT PERSONAL DATA ARE ACCURATE AND UP-TO-DATE WHEN NECESSARY:

Keeping personal data accurate and up-to-date is fundamental for the protection of the fundamental rights and freedoms of data owners.

In order to ensure that personal data are kept accurate and up-to-date, the accuracy of the sources from which personal data are collected is tested and reasonable precautions are taken in this context. In this regard, data owners are given the right to request correction or deletion of their inaccurate and outdated data.

c. PROCESSING OF PERSONAL DATA FOR SPECIFIC, EXPLICIT AND LEGITIMATE PURPOSES:

Personal data are processed for specific, explicit and lawful purposes. Within this framework, our company determines the purposes for which personal data will be processed through the ‘‘personal data processing inventory’’ stipulated by the legislation, notifies these purposes to the data owners before the personal data are processed and, if necessary, obtains the explicit consent of the data owners beforehand. Personal data are processed only after this notification is made and consent is obtained.

d. PERSONAL DATA MUST BE RELEVANT, LIMITED AND PROPORTIONATE TO THE PURPOSE FOR WHICH THEY ARE PROCESSED:

‘‘Being limited to the purpose’’ is one of the most important principles that prevail in the protection of personal data. Personal data shall be relevant, limited and proportionate to the purpose for which they are processed. In this direction, our company avoids processing personal data that are not related to the purpose of processing or are not needed. Personal data are not processed for purposes that do not currently exist and are foreseen to be realized in the future. In our company, it is essential to minimize the data processing activity.

e. RETENTION OF PERSONAL DATA FOR THE PERIOD STIPULATED IN THE RELEVANT LEGISLATION OR REQUIRED FOR THE PURPOSE FOR WHICH THEY ARE PROCESSED:

Regarding the retention of personal data, in case there is a period stipulated in the legislation for the retention of data, this period is complied with and personal data are retained only for the period required for the purpose for which they are processed.

2. CONDITIONS FOR THE PROCESSING OF PERSONAL DATA:

While carrying out personal data processing activities, our company acts in accordance with the data processing conditions determined by Articles 5 and 6 of the KVKK, provided that it complies with the basic principles. In this respect, in terms of the personal data processing activities that are carried out, it is determined whether the explicit consent of the data owner or one of the other data processing conditions that do not require explicit consent is available. In the absence of the personal data processing conditions stipulated in Articles 5 and 6 of the KVKK, personal data processing activities are not carried out.

3. TRANSFER OF PERSONAL DATA TO THIRD PARTIES:

While carrying out personal data processing activities in accordance with the KVKK, personal data are transferred to third parties located in the country and abroad by taking adequate protection measures only in the presence of the explicit consent of the data owner in accordance with Articles 8 and 9 of the KVKK or one of the other circumstances where explicit consent is not sought.

All necessary precautions are taken to prevent personal data from being accessed by unauthorized third parties.

4. NOTIFICATION OF PERSONAL DATA OWNERS:

It is the most natural right of personal data owners to be notified about the processing of their personal data.

As the data supervisor, our company notifies the owners of the personal data it processes (for instance: personnel, personnel candidate, visitor, customer) about the following issues in accordance with Article 10 of the KVKK and the ‘‘Communique on the Procedures and Principles to be Followed in the Fulfilment of the Obligation to Notify’’, taking into account the specific characteristics of each situation:
 

  • The purpose for which personal data are processed,
  • To whom and for what purpose the processed personal data are transferred,
  • The method and legal grounds for collecting personal data and
  • The rights of the personal data owner regulated in Article 11 of the KVKK.

5. ENSURING DATA SECURITY:

In accordance with Article 12 of the KVKK, all necessary technical and administrative precautions are taken by our Company, which is aware of the importance of ensuring the security of personal data and observing the fundamental rights and freedoms of data owners, to ensure the appropriate level of security in line with the purposes listed below:

  • To prevent unlawful processing of personal data,
  • To prevent illegal access to personal data and
  • To ensure the preservation of personal data.

6. DELETION, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA:

Pursuant to Article 7 of the KVKK and the "Regulation on Deletion, Destruction or Anonymization of Personal Data", there is a legal obligation for the deletion, destruction and anonymization (destruction) of personal data ex officio or upon the request of the relevant data owner, in the event that the reasons requiring the processing of the data are no longer applicable, although they have been processed in accordance with the KVKK and other relevant legislation. Necessary procedures and a separate policy have been prepared in our company to fulfil these obligations. In this direction, personal data that are not needed and in case the reasons requiring the processing of data in our company cease to exist are immediately destroyed. Moreover, in periodic intervals, personal data that need to be destroyed, their users and the access methods of the users are determined and the necessary destruction procedures are carried out in accordance with the KVKK and the relevant legislation and access to personal data is eliminated.

7. APPLICATION TO OUR COMPANY:

Pursuant to Article 13 of the KVKK and the "Communiqué on the Procedures and Principles of Application to the Data Supervisor" your requests regarding your personal data are finalized by our company, as the data supervisor, as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. As a personal data owner, you can submit your requests regarding your rights in writing via following e-mail address: [email protected]

As the personal data owner, you have the rights listed below:

  • Learn whether your personal data are processed or not;
  • Demand information regarding processing of your personal data in case it is processed;
  • Learn the reason why your personal data are processed and whether your personal data are used according to declared purposes or not;
  • Learn the third parties to whom your personal data are transferred within the borders of our country or abroad;
  • Ask for correction in case your personal data are processed deficiently or improperly, and request that the transactions made within this scope be notified to third parties to whom your personal data have been transferred;
  • Request your personal data to be deleted or destroyed in the event that the reasons requiring the processing of your personal data cease to exist in spite of the fact that your personal data have been processed in compliance with the provisions of KVKK and other relevant laws, and request that the transactions made within this scope be notified to third parties to whom your personal data have been transferred;
  • Object to any negative consequence that the data owner faces due to the fact that her/his personal data have been exclusively analyzed through automated systems;
  • Demand to be indemnified in case you suffer a loss resulting from the fact that your personal data have been processed illegally.