Personal Data Policy
[Company Name / Brand] Personal Data Policy
General information about the Personal Data Protection Law
Law No. 6698 on the Protection of Personal Data (hereinafter referred to as KVKK) was adopted on 24 March 2016 and published in the Official Gazette No. 29677 dated 7 April 2016. Part of the KVKK entered into force on the date of publication, and the remainder on 7 October 2016.
Information as the data controller
Under Law No. 6698 on the Protection of Personal Data (KVKK) and in our capacity as Data Controller, your personal data, within the framework described on this page, may be recorded, stored, updated, disclosed / transferred to third parties where permitted by legislation, classified, and processed in the ways listed in the KVKK.
How your personal data may be processed
Under Law No. 6698 on the Protection of Personal Data (KVKK), the personal data you share with our Company may be processed by us, whether wholly or partly by automatic means, or by non-automatic means provided that it forms part of any data recording system. This includes obtaining, recording, storing, altering and reorganising the data — in short, any operation performed on the data. Under the KVKK, any operation performed on data is regarded as "processing of personal data".
Purposes and legal grounds for processing your personal data
The personal data you share,
- In order to carry out the services we provide to our customers in line with the requirements of the contract and of technology, and to improve the products and services we offer;
- Under Law No. 6563 on the Regulation of Electronic Commerce and Law No. 6502 on Consumer Protection, and on the basis of the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in Official Gazette No. 29457 dated 26.08.2015, the Distance Contracts Regulation published in Official Gazette No. 29188 dated 27.11.2014, and other relevant legislation, in order to record identity, address and other necessary information to establish the identity of the transaction party;
- In order to arrange all records and documents that will serve as a basis for transactions in electronic contracts or on paper, as required in the field of Banking and Electronic Payment, and to comply with the information retention, reporting and disclosure obligations required by legislation and prescribed by other authorities;
- In matters concerning public security and in legal disputes, in order to be able to provide information to public prosecutors' offices, courts and the relevant public officials upon request and as required by legislation;
They will be processed in accordance with Law No. 6698 (KVKK) and the related secondary legislation. Information on third parties or organisations to which your personal data may be transferred: For the purposes stated above, the persons/organisations to which the personal data you share with our Company may be transferred are, first and foremost, IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our Company's e-commerce infrastructure, together with persons and organisations related to the services provided, such as suppliers and cargo companies, partner organisations with which we cooperate and from which we receive services in order to carry out our activities and/or in the capacity of Data Processor, domestic/foreign organisations, and other third parties.
How your personal data is collected
Your personal data,
- Through the forms on our company's website and mobile applications, we process information such as your name, surname, Turkish ID number, address, telephone number and business or personal e-mail address; your preferences on pages accessed with a username and password, the IP records of the transactions carried out, cookie data collected by the browser, data covering browsing duration and details, and location data;
- Through our sales and marketing department staff, our branches, suppliers, other sales channels, paper forms, business cards, digital marketing and call centre, whether verbally, in writing or in electronic form;
- From persons who share their personal data with our company for purposes such as establishing a commercial relationship, applying for a job or submitting an offer, by means of business cards, résumés (CVs), offers and other channels, in a physical or virtual environment, face to face or remotely, verbally, in writing or electronically;
- In addition, data obtained indirectly through different channels may be processed and collected, including data from websites, blogs, contests, surveys, games, campaigns and similar (micro) websites and from social media, e-newsletter reading or click activity, data offered by publicly available databases, and publicly shareable profiles and data from social media platforms.
Your personal data obtained before the KVKK (Turkish Personal Data Protection Law) came into force
Personal data that was lawfully obtained before 7 April 2016, the effective date of the KVKK (Turkish Personal Data Protection Law), through membership, electronic message consent, product / service purchases and other means is also processed and retained in accordance with the terms and conditions set out in this document.
Transfer of your personal data abroad
Your personal data collected through any of the methods listed above, whether processed in Türkiye or processed outside Türkiye and stored there, may also be transferred to service providers located abroad (in countries accredited by the Personal Data Protection Authority and offering adequate protection of personal data), provided that it remains within the scope of the KVKK (Law No. 6698 on the Protection of Personal Data) and in line with the purposes of the contract.
Storage and Protection of Personal Data
Your personal data will be kept confidential in the databases and systems held by our Company in accordance with Article 12 of the KVKK (Turkish Personal Data Protection Law), and will not be shared with third parties in any way, except for legal obligations and the arrangements set out in this document. Pursuant to Article 12 of the KVKK, our Company is obliged to prevent the unlawful processing of personal data, to prevent unauthorised persons from accessing the systems and databases in which your personal data is held, and to take software-based measures such as access management as well as physical security measures. If it is discovered that personal data has been obtained by others through unlawful means, the situation will be reported immediately, in writing and in accordance with the legal regulations, to the Personal Data Protection Board.
Keeping personal data up to date and accurate
Under Article 4 of the KVKK (Turkish Personal Data Protection Law), our Company is obliged to keep your personal data accurate and up to date. To enable our Company to fulfil its obligations under the applicable legislation, our Customers must share accurate and up-to-date data, or update it via the website / mobile application.
Rights of the data subject under KVKK (Law No. 6698)
Article 11 of the Personal Data Protection Law (KVKK) No. 6698 entered into force on 7 October 2016. Pursuant to that article, the rights of the Data Subject from that date onwards are as follows: The Data Subject may apply to our Company (the data controller) and request the following regarding themselves;
- Learning whether personal data is being processed,
- The right to request information on whether your personal data has been processed,
- The right to learn the purpose of processing personal data and whether it is used in accordance with that purpose,
- The right to know the third parties to whom personal data is transferred, whether in Türkiye or abroad,
- the right to request correction of personal data that has been processed incompletely or incorrectly,
- To request the erasure or destruction of personal data under the conditions set out in Article 7 of the KVKK (Turkish Personal Data Protection Law),
- In the event of correction, deletion or destruction of personal data, the right to request that these actions be notified to third parties to whom the personal data has been transferred,
- The right to object to an outcome that is to your detriment arising from the analysis of the processed data exclusively by automated systems,
- The right to request compensation for damages suffered as a result of unlawful processing of personal data,
...the rights. [................] is the Data Controller under KVKK (Turkish Personal Data Protection Law), registered with the [..........................] registry number of the [................] Chamber of Commerce, holding MERSIS number [.............................], and located at [.......................................................................] [Full company name]. The Data Controller Representative to be appointed by our company will be announced in the Data Controllers Registry and at the internet address where this document is located, once the legal infrastructure is in place. Data Subjects may direct their questions, opinions or requests to any of the following contact channels:
E-mail: [.........................]
Phone: [.........................]
Fax: [.............................]