INFORMATION TEXT REGARDING THE PROCESSING OF PERSONAL DATA

Data Controller, Personal Data Categories and Collection Methods

In accordance with the Personal Data Protection Law No. 6698 ("Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR"); your personal data in the form of identity, communication, customer transactions, and transaction security are collected from you or from third parties through written data transfer electronically and by automated means, and are processed by us as the data controller at [email protected] ("Company") within the scope detailed below.

Personal Data Privacy Principles

You can access the principles that our Company follows while ensuring data privacy from the Web Privacy and Personal Data Protection Principles text on our website.

Purposes and Legal Basis for Processing Personal Data

The personal data collected by us is processed based on the following purposes and legal grounds.

 

Purpose of Data Processing	Personal Data Categories	Legal reason
Conducting Activities in Compliance with Legislation	Transaction Security	Law No. 6698 Article 5/2-a: Explicit provision in laws. Law No. 6698 Article 5/2-c: Being mandatory for the data controller to fulfill its legal obligation.
Conducting Information Security Processes	Transaction Security
Conducting Storage and Archiving Activities	Identity, Communication, Customer Transactions, Transaction Security
Conducting Membership Processes	Identity, Communication, Customer Transactions	Law No. 6698 Article 5/2-c: Being necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
Conducting Communication Activities	Identity, Communication, Customer Transactions, Transaction Security	Law No. 6698 Article 5/1: Having the explicit consent of the data subject
Conducting Customer Satisfaction Processes

• Transfer of Personal Data

Your personal data may be transferred to third parties under the following conditions:

Legal Basis for Transfer	Purpose of Transfer	Recipient Party
Law No. 6698 Article 8/2-a: Being necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject	Transfer of necessary information to our business partners for conducting information security processes	Business Partners
Law No. 6698 Article 8/2-a: Being mandatory for the data controller to fulfill its legal obligation	Conducting activities in compliance with legislation	Authorized Public Institutions

 

•  Retention Periods for Personal Data

The retention periods for personal data processed by the Company are as follows:

Personal Data Category	Retention Period
Identity	10 years from the end of the legal relationship
Communication	10 years from the end of the legal relationship
Customer Transaction	10 year
Transaction Security	6 month

 

INFORMATION TEXT REGARDING THE PROCESSING OF PERSONAL DATA

Data Controller, Personal Data Categories and Collection Methods

In accordance with the Personal Data Protection Law No. 6698 ("Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR"); your personal data in the form of identity, communication, customer transactions, and transaction security are collected from you or from third parties through written data transfer electronically and by automated means, and are processed by us as the data controller at [email protected] ("Company") within the scope detailed below.

Personal Data Privacy Principles

You can access the principles that our Company follows while ensuring data privacy from the Web Privacy and Personal Data Protection Principles text on our website.

Purposes and Legal Basis for Processing Personal Data

The personal data collected by us is processed based on the following purposes and legal grounds.

Personal Data Security Measures

You can access the measures taken by our Company to ensure data privacy from the Web Privacy and Personal Data Protection Principles text on our website.

Your Rights Regarding Personal Data

Rights Regarding Personal Data Under Law No. 6698

The rights that groups of persons can exercise regarding their personal data are included in Article 11 of Law No. 6698 and are as follows:

• Learning whether personal data is processed,
• Requesting information about it if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom personal data is transferred domestically or abroad,
• Requesting the correction of personal data if it has been processed incompletely or incorrectly,
• Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law and requesting that the operations performed in accordance with these provisions be notified to third parties to whom personal data has been transferred,
• Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
• Requesting compensation for damages if damaged due to the unlawful processing of personal data.

Rights Regarding Personal Data Under GDPR

The rights that groups of persons can exercise regarding their personal data are included in Chapter 3 of GDPR (Articles 12-23) and are listed below:

• Withdrawing consent if your personal data is processed based on your explicit consent;
• Requesting the restriction of the processing of your personal data in the following cases:
  • For a period during which we can verify the accuracy if the accuracy of your personal data has been objected to by you,
  • If data processing is unlawful but you prefer to restrict the use of your data rather than delete it,
  • If the processing of your personal data is no longer necessary for the relevant data processing purpose but is necessary for the establishment, application, or presentation of your legal claims or demands, or
  • During the examination of whether the objection is invalid due to our interests following your right of objection exercised in accordance with Article 21 of GDPR;
• Objecting to the processing of your personal data, including profiling applications, if your personal data is processed based on the public interest or the authority given to the data controller by law or the legitimate interest of the data controller or a third party;
• Accessing the following information:
  • Confirming that personal data about you is being processed and, in this case, your relevant personal data and the purposes and categories of data processing,
  • Data recipients or their categories with whom your personal data is shared or will be shared, if possible, the period for which your personal data will be stored, if this is not possible, the criteria used to determine this period,
  • The existence of the right to request the restriction, deletion, or destruction of the processing of personal data, to object to the processing of personal data, and to apply to the supervisory authority, and
  • Information that personal data was obtained from the data subject or a third party, and
  • Accessing information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for you;
• If your personal data is processed based on your explicit consent or a contract provision and data processing is carried out through automated mechanisms, transferring the version of your data in a regular, usable, and machine-readable format to you or, if technically reasonable, to another data controller;
• You have the right to obtain information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for the data subject.

Application Procedure and Principles

You can submit your rights and requests regarding personal data to us by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our website, or by your application that meets the minimum conditions stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the following methods. As the Company, we will conclude your application free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company.

 

Application Procedure	Application Address
Electronic message you will send via KEP	[email protected]
The message you send will be sent via the email address registered in our system or with a secure electronic signature or mobile signature	[email protected]
Application that you submit in writing, either in person or through a notary public	Fabrikalar Mah. Namık Kemal Blv. DalgakulePlaza / 51 B/28

Effectiveness and Updatability

This privacy policy entered into force on the date of its publication. This privacy policy is updated to adapt to changing conditions and legislation. The privacy policy, updated in light of current Board decisions and requirements, is monitored by the Company and published on its website.