Personal Data Protection Law
1. CONTROLLER
- Controller Company Name
- Central Registration System No /
Identification Number - Registered E-Mail Address
- Telephone / Fax
- Web Address For Detailed Information
- Mailing Address
- Relevant Person’s Application E-Mail Address
2. PURPOSE AND SCOPE OF THE CLARIFICATION TEXT
- The purpose of this Personal Data Processing Clarification Text is to fulfill the obligation of informing individuals about the use of their personal data processed by our organization, as required by Article 10 of the Law No. 6698 on the Personal Data Protection Law (PDPL).
- According to Article 3 of the Law No. 6698 on the Personal Data Protection Law (PDPL), personal data refers to any information that identifies or makes an individual identifiable. This includes, but is not limited to, details such as Name, Surname, National ID Number, Video Record, Address, Salary, IP Address, Log, Email, and other similar data.
- Your personal data is processed by our organization, as the Controller, in accordance with the general principles specified in Article 4 of Law No. 6698 on the Personal Data Protection Law (PDPL) and based on one or more of the conditions for processing personal data stated in Article 5 of the PDPL.
- According to Article 5 of Law No. 6698 on the Personal Data Protection Law (PDPL), some of your data may be processed without your explicit consent, provided that the processing complies with the legal exceptions. However, certain data can only be processed based on your "informed and voluntarily given consent related to a specific subject." You may withdraw your explicit consent for the processing of your data at any time by applying to our organization using the "Data Subject Application Form" in accordance with Article 11 of Law No. 6698 and the "Your Rights" section of this notice. If you withdraw your consent, the relevant data will be deleted unless it is processed for other purposes. Otherwise, it will continue to be processed based on the purposes and legal grounds without your explicit consent.
3. PERSONAL DATA THAT MAY BE PROCESSES, PURPOSES OF DATA PROCESSING, AND LEGAL GROUNDS
The personal data processed by our organization as the Controller, along with their processing purposes and legal grounds (explicit consent/legal exceptions), are detailed below:
Identity
Name and Surname, Identification Number, Foreign Identification Information, Passport Information
Execution of information security processes, ensuring activities are conducted in compliance with regulations, execution/monitoring of business activities, execution of goods/service sale contracts, management of storage and archiving activities, management of contract processes, ensuring the security of data controller operations, providing information to authorized individuals, institutions, and organizations, and monitoring and managing legal affairs
Processing of personal data as explicitly provided by laws, when necessary for the establishment or performance of a contract directly related to the parties of the contract, and when necessary for the data controller to fulfill their legal obligations.
Communication
Registered Electronic E-Mail Address, Telephone Number, E-Mail, Address
Ensuring that activities are conducted in compliance with regulations, managing finance and accounting operations, conducting communication activities, monitoring and managing legal affairs, ensuring the security of data controller operations, executing goods/service sale contracts, managing storage and archiving activities, managing customer relationship processes, providing post-sale support services, conducting/monitoring business activities, ensuring business continuity activities, managing marketing analysis studies, managing performance evaluation processes, executing marketing processes for products/services, managing contract processes, tracking requests/complaints, ensuring the security of movable property and resources, and managing marketing processes for products/services.
Processing of personal data is necessary when it is directly related to the establishment or performance of a contract with the parties involved, and when it is essential for the data controller to fulfill their legal obligations.
Legal Transaction
Company/Institution Information / Position Information within the Company/Institution, Signature, Tax Identification Number / Tax Office, Signature/Signature Declaration/Signature Circular, Goods/Service Information
Execution of information security processes, ensuring that activities are conducted in compliance with regulations, management of finance and accounting operations, monitoring and managing legal affairs, conducting/monitoring business activities, management of storage and archiving activities, management of contract processes, ensuring the security of movable property and resources, ensuring the security of data controller operations, providing information to authorized individuals, institutions, and organizations, execution of compensation policies, management of risk management processes, execution of logistics activities, and execution of strategic planning activities.
Processing of personal data as explicitly provided by laws, when necessary for the establishment or performance of a contract directly related to the parties of the contract, and when necessary for the data controller to fulfill their legal obligations.
Finance
Bank Account Information, Payment / Current Account Information, Collateral Information
Ensuring that activities are conducted in compliance with regulations, managing finance and accounting operations, conducting communication activities, ensuring the security of data controller operations, executing goods/service sale contracts, conducting/monitoring business activities, managing risk management processes, managing storage and archiving activities, managing contract processes, executing compensation policies, conducting strategic planning activities, providing information to authorized individuals, institutions, and organizations, monitoring and managing legal affairs, ensuring the security of movable property and resources, and ensuring the security of data controller operations.
Processing personal data of the parties to the contract, provided that it is directly related to the establishment or performance of the contract, is necessary for the data controller to fulfill its legal obligations and is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Identity – Communication – Visual and Auditory Records – Marketing
Identity: Name, Special Occasion Information (For celebrating your special days and national, public, religious, and other special days, sending gifts/cards or other items, sending commercial electronic communications for marketing purposes, using in website, social media, company catalog, and other platforms, and for conducting surveys or draws).
Communication: Phone Number, Email, Address (For celebrating your special days and national, public, religious, and other special days, sending gifts/cards or other items, sending commercial electronic communications for marketing purposes, using in website, social media, company catalog, and other platforms, and for conducting surveys or draws).
Visual and Auditory Records: Photographs, Videos, and Personal Data Declared/Shared in These Records (For use in website, social media, company catalog, and other platforms).
Marketing: Survey Information, Sweepstakes Information (For conducting surveys and sweepstakes).
Conducting Communication Activities, Implementing Customer Satisfaction Activities, Managing Advertising/Campaign/Promotion Processes, Executing Strategic Planning Activities, Managing Marketing Processes for Products/Services, Providing Post-Sales Support Services, Managing Customer Relationship Management Processes, Managing Storage and Archiving Activities, Managing Contract Processes, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Individuals, Institutions, and Organizations.
It may be processed with your explicit consent.
4. PERSONAL DATA COLLECTION METHOD
Your personal data may be collected verbally, in writing, or electronically; through the contact form or other channels available on our website, physical locations, and other areas where you interact with us. This includes activities related to promoting or advertising your business on our website or mobile application. Data collection may occur during customer satisfaction and advertising/marketing activities (such as sending commercial electronic communications, celebrating special occasions, sharing photo and video records, conducting surveys or sweepstakes), as well as during the submission of requests, complaints, and suggestions. Depending on the nature of the service or activity and the channel through which you communicate with us, all information and documents provided by you or obtained through official institutions and organizations, or other third parties, may be collected through automatic or non-automatic means, including being part of any data recording system.
5. TRANSFER OF PERSONAL DATA
- Your personal data may be transferred in accordance with Article 8 of the Personal Data Protection Law (PDPL) and other relevant regulations and limited to the purposes mentioned above. This includes transfers to public institutions and organizations (such as the Ministry of Finance, the Revenue Administration, the Ministry of Environment and Urbanization, the Ministry of Trade, the Chamber of Commerce, the Chamber of Industry, the Exporters' Association, Customs Consultancy, etc.), departments within our data controller business, shareholders, customers, suppliers such as transportation companies, courier services, banks, lawyers, financial advisors, website and infrastructure providers, IT/support firms, and other entities that we cooperate with to perform our activities. Transfers may also occur to organizations and other third parties responsible for ensuring the protection of personal data, preventing unauthorized access, and preventing illegal processing of data.
- If you have given explicit consent, your personal data, including your name, surname, photo, video, and the personal data declared/shared in these records, may be collected by our company during events and organizations that we organize or participate in. This data may be used for advertising and marketing purposes and shared with the public via our website, company catalogs, social media, and other channels. Additionally, it may be shared with our suppliers (such as agencies and IT/support firms) to facilitate this activity.
- If you provide explicit consent, your personal data, including your name, surname, phone number, email address, and other personal details, may be processed for advertising and marketing purposes. This data may be used to send you commercial electronic communications. To facilitate this activity, it may also be shared with our suppliers (such as agencies and IT/support firms) and IYS AŞ.
- If you provide explicit consent, your personal data, including your name, surname, special occasion information, phone number, email address, and address, may be processed for employee satisfaction and advertising-marketing purposes. This data may be used to celebrate your special days and national-religious holidays, and/or to send gifts/cards and other items to you. To facilitate these activities, it may be shared with our suppliers (such as agencies, courier companies, and IT/support firms).
- If you provide explicit consent, your personal data, including your name, surname, phone number, email address, survey information, and sweepstakes information, may be processed for advertising-marketing and customer satisfaction purposes. This data may be used to participate in surveys and sweepstakes organized by our company. If the survey or sweepstakes results are made public, this information may be shared with the public via our website, company catalogs, social media, and other channels. Additionally, to facilitate these activities, it may be shared with our suppliers (such as agencies and IT/support firms).
- Your personal data is not transferred abroad.
6. YOUR RIGHTS
- In accordance with Article 11 of the Personal Data Protection Law No. 6698, which governs the rights of data subjects, you have the right to learn whether your personal data is being processed and, if so, to request information about this processing. You can also learn the purpose of processing your data and whether it is being used in accordance with that purpose. Additionally, you have the right to know about third parties to whom your data is transferred, both within and outside the country. If your data is incomplete or incorrect, you may request its correction. Even if the processing follows the law, you have the right to request the deletion or destruction of your data if the reasons for processing no longer exist. If your data has been transferred to third parties, you can request that any corrections, deletions, or destructions be communicated to those third parties. Furthermore, if a result is produced against you solely through automated systems, you have the right to object. If you suffer damage due to unlawful processing of your data, you are entitled to request compensation for the damage.
- As a data subject, you can submit your requests by filling out the "Data Subject Application Form" available at the website address above. According to the Communiqué on the Principles and Procedures for Applications to the Data Controller, you can submit your application in writing via notary public or by registered mail with return receipt to the postal address provided above. Alternatively, you can use registered electronic mail (KEP), secure electronic signature, mobile signature, or the electronic mail address registered in our system that you have previously provided to us. You can also send your request to the KEP address, or the email address designated for KVKK communications mentioned above.
UNDERSTOOD IT, AND RECEIVED A COPY.
In accordance with the Personal Data Protection Law No. 6698 (KVKK), your personal data, for which you provide explicit consent below, may be processed and shared by us, the data controller, limited to the purpose of processing. You may withdraw your explicit consent at any time using the channel you selected based on the information provided to you in our clarification notice above. Please indicate your acceptance or rejection of the processing of your personal data by marking the relevant box below with an (X), your signature, or another similar mark.
| Personal Data Subject to Explicit Consent | I GIVE My Explicit Consent |
I DO NOT GIVE My Explicit Consent |
| To receive commercial electronic communications, including campaign, promotion, and advertising content, to have my personal data processed for this purpose, and to have my data shared with your suppliers and İYS AŞ. | ||
| To have my special days, national, public, religious, and other occasions celebrated by your business, and to receive celebration gifts/cards/commercial electronic communications; for this purpose, to have my personal data processed and shared with your suppliers. | ||
| To have my personal data processed for advertising/marketing purposes during events and organizations organized or attended by your business, to be shared on websites and other platforms as well as with the public, and to be shared with your suppliers for the execution of this activity. | ||
| To have my personal data processed for surveys and sweepstakes conducted by your business for advertising/marketing and customer satisfaction purposes, and to have my data shared on websites and other platforms as well as with the public. |
UNDERSTOOD IT, AND RECEIVED A COPY.
