These Privacy and Personal Data Protection Principles (hereinafter referred to as the "Principles") determine the principles adopted by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (hereinafter referred to as the "Company") regarding the protection of personal data and aim to inform all relevant groups of individuals within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as "Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR").
As the Company, in our capacity as Data Controller, we process your personal data within the framework of the following principles:
In processing your personal data, we act in accordance with the principles introduced by legal regulations and the rules of general trust and fairness. In accordance with this principle, we take into account your interests and reasonable expectations while trying to achieve our personal data processing purposes, do not abuse our rights, and act in accordance with the principle of transparency in our data processing activities.
In line with this principle, which emphasizes the importance of the accuracy and currency of personal data, periodic checks and updates are made to ensure that the processed data is accurate and current, taking into account your legitimate interests, and necessary measures are taken accordingly. In this context, systems are being established within the Company to check the accuracy of personal data and make necessary corrections. Additionally, the accuracy of the sources from which personal data is collected is checked, and requests arising from inaccurate personal data are taken into consideration. Therefore, this principle is applied in accordance with your right to request the correction of your personal data under Law No. 6698.
Your personal data is processed based on clear, specific, and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by the relevant persons, and we determine and clearly express the purposes and legal processing conditions on which they are based in Article 3 of these Principles.
Your personal data is processed in a proportionate, relevant, and limited manner to achieve the intended purpose(s), and we avoid processing personal data that is not related to or unnecessary for achieving the purpose. Also within the scope of this principle, personal data is not collected or processed for purposes that do not currently exist and are thought to be realized later.
Your personal data is only retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which it is processed. In this regard, the Company takes and implements the relevant administrative and technical measures. In this context, first, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data; if a period is determined, this period is complied with; if no period is determined, personal data is stored for as long as necessary for the purpose for which it is processed. When the necessity of the relevant processes ceases, access to your personal data by irrelevant departments is prevented within the scope of the deletion action specified in Law No. 6698. Upon expiration of the period or cessation of the reasons requiring processing, in the absence of a legal reason allowing longer processing, your personal data is destroyed or anonymized in accordance with personal data protection legislation.
Your personal data, including your personal and special categories of personal data within the scope of Law No. 6698, can be processed within the framework of the conditions stipulated below:
The basic rule is that personal data cannot be processed without the explicit consent of the relevant persons; according to this exception, your personal data may be processed in cases where personal data processing is explicitly stipulated in laws.
In cases where it is necessary to process the personal data of the data subject who is unable to express consent due to factual impossibility or whose consent cannot be considered valid, in order to protect the life or physical integrity of the data subject or another person, your personal data may be processed.
Your personal data may be processed if processing personal data belonging to the parties to the contract is necessary, provided that it is directly related to the establishment or performance of the contract.
Your personal data may be processed if processing is mandatory for the Company to fulfill its legal obligations under the legislation, contracts, and similar legal obligations to which it is bound and for which it is responsible.
If your personal data has been disclosed by you, that is, shared with the public by you, it may be processed in a manner relevant and proportionate to the purpose of disclosure.
Your personal data may be processed if data processing is necessary for the establishment, exercise, or protection of the right within the scope of conducting and managing processes related to the Company's legal and commercial rights.
Your personal data may be processed if data processing is necessary for the legitimate interests of the Company. When our Company needs to process data based on this processing condition, it makes an assessment taking into account your fundamental rights and freedoms and makes a decision based on the results of the assessment.
Although processing personal data based on explicit consent is the main rule, in the presence of other conditions specified in this article, the explicit consent of the data subjects is not relied upon. Otherwise, abuse of rights may be mentioned. In this context, your personal data is processed based on your explicit consent in cases where it is not processed based on any of the conditions specified in these Principles.
Special categories of personal data are processed only under the following conditions in accordance with Article 6 of Law No. 6698: a) Having the explicit consent of the data subject, b) Explicit provision in laws, c) Being necessary for the protection of the life or physical integrity of the person who is unable to express consent due to factual impossibility or whose consent is not legally recognized, or another person, d) Relating to personal data disclosed by the data subject and in accordance with the intention to disclose, e) Being necessary for the establishment, exercise, or protection of a right, f) Being necessary for persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of health services, g) Being mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, h) Being directed towards current or former members and affiliates of foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or union purposes, or persons who are in regular contact with these organizations and formations, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their field of activity, and not disclosed to third parties.
Your personal and special categories of data may be transferred to our domestic business partners, public institutions and organizations and similar entities, or to our foreign business partners within the scope of Article 2 of these Principles. When making such transfers, compliance with Articles 8 and 9 of Law No. 6698 is observed. If necessary, your explicit consent is obtained and the transfer is provided within this framework.
The Company takes all reasonable administrative and technical measures to ensure the security of personal data, to prevent unlawful processing, to prevent the risks of unauthorized access, accidental data loss, intentional deletion of data, or damage to data.
All reasonable technical and physical measures are taken to prevent access to personal data by persons other than those authorized to access it. In this context, the authorization system is designed in such a way that persons and systems cannot access more personal data than necessary.
The Company conducts and has conducted the necessary audits to ensure the implementation of the provisions of Law No. 6698 in its own institution or organization.
The measures taken are as follows:
The rights that groups of persons can exercise regarding their personal data are included in Article 11 of Law No. 6698 and are as follows:
The rights that groups of persons can exercise regarding their personal data are included in Chapter 3 of GDPR (Articles 12-23) and are listed below:
As a data subject, if you have a request regarding your rights related to your personal data, you can send it to us by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our website, or by your application that meets the minimum conditions stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the following methods. As the Company, we will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company. Upon your application to us, you can inform us if your application is rejected, if the response is found insufficient, or if the application is not answered in time. Additionally, as a data subject, you have the right to apply to the competent data protection authority in your country within thirty days from the date you learn of our response and in any case within sixty days from the date you make your proper application.
PRIVACY AND PERSONAL DATA PROTECTION PRINCIPLESPURPOSE AND SCOPEThese Privacy and Personal Data Protection Principles (hereinafter referred to as the "Principles") determine the principles adopted by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (hereinafter referred to as the "Company") regarding the protection of personal data and aim to inform all relevant groups of individuals within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as "Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR"). PRINCIPLES REGARDING THE PROCESSING OF YOUR PERSONAL DATAAs the Company, in our capacity as Data Controller, we process your personal data within the framework of the following principles: Lawful and Fair ProcessingIn processing your personal data, we act in accordance with the principles introduced by legal regulations and the rules of general trust and fairness. In accordance with this principle, we take into account your interests and reasonable expectations while trying to achieve our personal data processing purposes, do not abuse our rights, and act in accordance with the principle of transparency in our data processing activities. Ensuring Personal Data is Accurate and Up-to-Date When NecessaryIn line with this principle, which emphasizes the importance of the accuracy and currency of personal data, periodic checks and updates are made to ensure that the processed data is accurate and current, taking into account your legitimate interests, and necessary measures are taken accordingly. In this context, systems are being established within the Company to check the accuracy of personal data and make necessary corrections. Additionally, the accuracy of the sources from which personal data is collected is checked, and requests arising from inaccurate personal data are taken into consideration. Therefore, this principle is applied in accordance with your right to request the correction of your personal data under Law No. 6698. Processing for Specific, Clear, and Legitimate PurposesYour personal data is processed based on clear, specific, and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by the relevant persons, and we determine and clearly express the purposes and legal processing conditions on which they are based in Article 3 of these Principles. Being Relevant, Limited, and Proportionate to the Purpose for Which They Are ProcessedYour personal data is processed in a proportionate, relevant, and limited manner to achieve the intended purpose(s), and we avoid processing personal data that is not related to or unnecessary for achieving the purpose. Also within the scope of this principle, personal data is not collected or processed for purposes that do not currently exist and are thought to be realized later. Retention for the Period Required by Relevant Legislation or for the Purpose for Which They Are ProcessedYour personal data is only retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which it is processed. In this regard, the Company takes and implements the relevant administrative and technical measures. In this context, first, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data; if a period is determined, this period is complied with; if no period is determined, personal data is stored for as long as necessary for the purpose for which it is processed. When the necessity of the relevant processes ceases, access to your personal data by irrelevant departments is prevented within the scope of the deletion action specified in Law No. 6698. Upon expiration of the period or cessation of the reasons requiring processing, in the absence of a legal reason allowing longer processing, your personal data is destroyed or anonymized in accordance with personal data protection legislation. CONDITIONS FOR PROCESSING YOUR PERSONAL DATAYour personal data, including your personal and special categories of personal data within the scope of Law No. 6698, can be processed within the framework of the conditions stipulated below: Explicit Provision in LawsThe basic rule is that personal data cannot be processed without the explicit consent of the relevant persons; according to this exception, your personal data may be processed in cases where personal data processing is explicitly stipulated in laws. Impossibility of Obtaining the Explicit Consent of the Data Subject Due to Factual ImpossibilityIn cases where it is necessary to process the personal data of the data subject who is unable to express consent due to factual impossibility or whose consent cannot be considered valid, in order to protect the life or physical integrity of the data subject or another person, your personal data may be processed. Direct Relevance to the Establishment or Performance of a ContractYour personal data may be processed if processing personal data belonging to the parties to the contract is necessary, provided that it is directly related to the establishment or performance of the contract. Fulfillment of the Company's Legal ObligationYour personal data may be processed if processing is mandatory for the Company to fulfill its legal obligations under the legislation, contracts, and similar legal obligations to which it is bound and for which it is responsible. Disclosure of Personal Data by the Data SubjectIf your personal data has been disclosed by you, that is, shared with the public by you, it may be processed in a manner relevant and proportionate to the purpose of disclosure. Necessity of Data Processing for the Establishment or Protection of a RightYour personal data may be processed if data processing is necessary for the establishment, exercise, or protection of the right within the scope of conducting and managing processes related to the Company's legal and commercial rights. Processing of Data Based on Legitimate InterestYour personal data may be processed if data processing is necessary for the legitimate interests of the Company. When our Company needs to process data based on this processing condition, it makes an assessment taking into account your fundamental rights and freedoms and makes a decision based on the results of the assessment. Processing Based on Explicit ConsentAlthough processing personal data based on explicit consent is the main rule, in the presence of other conditions specified in this article, the explicit consent of the data subjects is not relied upon. Otherwise, abuse of rights may be mentioned. In this context, your personal data is processed based on your explicit consent in cases where it is not processed based on any of the conditions specified in these Principles. Processing of Special Categories of Personal DataSpecial categories of personal data are processed only under the following conditions in accordance with Article 6 of Law No. 6698: a) Having the explicit consent of the data subject, b) Explicit provision in laws, c) Being necessary for the protection of the life or physical integrity of the person who is unable to express consent due to factual impossibility or whose consent is not legally recognized, or another person, d) Relating to personal data disclosed by the data subject and in accordance with the intention to disclose, e) Being necessary for the establishment, exercise, or protection of a right, f) Being necessary for persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of health services, g) Being mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, h) Being directed towards current or former members and affiliates of foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or union purposes, or persons who are in regular contact with these organizations and formations, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their field of activity, and not disclosed to third parties. TRANSFER OF PERSONAL DATAYour personal and special categories of data may be transferred to our domestic business partners, public institutions and organizations and similar entities, or to our foreign business partners within the scope of Article 2 of these Principles. When making such transfers, compliance with Articles 8 and 9 of Law No. 6698 is observed. If necessary, your explicit consent is obtained and the transfer is provided within this framework. SECURITY OF PERSONAL DATAThe Company takes all reasonable administrative and technical measures to ensure the security of personal data, to prevent unlawful processing, to prevent the risks of unauthorized access, accidental data loss, intentional deletion of data, or damage to data. All reasonable technical and physical measures are taken to prevent access to personal data by persons other than those authorized to access it. In this context, the authorization system is designed in such a way that persons and systems cannot access more personal data than necessary. The Company conducts and has conducted the necessary audits to ensure the implementation of the provisions of Law No. 6698 in its own institution or organization. The measures taken are as follows:
RIGHTS OF THE DATA SUBJECTRights Regarding Personal Data Under Law No. 6698The rights that groups of persons can exercise regarding their personal data are included in Article 11 of Law No. 6698 and are as follows:
Rights Regarding Personal Data Under GDPRThe rights that groups of persons can exercise regarding their personal data are included in Chapter 3 of GDPR (Articles 12-23) and are listed below:
APPLICATION PROCEDURE AND PRINCIPLESAs a data subject, if you have a request regarding your rights related to your personal data, you can send it to us by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our website, or by your application that meets the minimum conditions stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the following methods. As the Company, we will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company. Upon your application to us, you can inform us if your application is rejected, if the response is found insufficient, or if the application is not answered in time. Additionally, as a data subject, you have the right to apply to the competent data protection authority in your country within thirty days from the date you learn of our response and in any case within sixty days from the date you make your proper application.
8. Effectiveness and Updatability
This Information Policy entered into force on the date of its publication. The Policy is updated to adapt to changing conditions and legislation. Updated in light of current Board decisions and requirements, the Policy is monitored by the Company and published on its website.
|
|||||||||
8. Effectiveness and Updatability
This Information Policy entered into force on the date of its publication. The Policy is updated to adapt to changing conditions and legislation. Updated in light of current Board decisions and requirements, the Policy is monitored by the Company and published on its website.
