Protecting the privacy of visitors to https://www.bogazicimakina.com/, the website operated by Boğaziçi Endüstriyel Mutfak ("Boğaziçi" or the "Company"), is one of our Company's core principles. This Privacy Notice sets out the principles governing the processing of your personal data by the Company, as the data controller located at "Karadeniz Mah. Cebeci Caddesi, No:171/A Küçükköy, Gaziosmanpaşa, Istanbul / Türkiye", in accordance with the Law No. 6698 on the Protection of Personal Data (the "Law") and related legislation.
Your personal data obtained through your visit to our website may be processed by Boğaziçi for the purposes listed below, in accordance with Articles 5 and 6 of the Law:
Limited to the purposes for which your personal data is processed, your personal data may be transferred to CRM and e-mail infrastructure providers, hosting service providers, cloud storage service providers, technical support and software service providers, legal and financial advisors, business partners and legally authorised public institutions and organisations, subject to the conditions set out in Articles 8 and 9 of the Law. Product drawings and technical files submitted in connection with custom product requests are not shared with third parties; they are made accessible only to the relevant sales, technical and R&D departments within the Company for the purpose of evaluating the request.
Your personal data is collected by Boğaziçi by automated means through cookies, which are technical communication files, as a result of your visit to our website, and through the forms you fill out for the purposes stated in this Privacy Notice. If you use the WhatsApp redirect button on our website, the relevant product information and the contact/request information you share via WhatsApp may be processed in order to receive your request and manage communication processes. Visitor movements and usage statistics on our website may be analysed through Google Analytics. Non-essential analytics cookies are run in line with user preferences to the extent required under the relevant legislation. You can find detailed information about cookies in our Cookie Policy. Your personal data is processed on the following legal grounds:
Pursuant to Article 11 of the Law, by applying to our Company, you have the right to: a) learn whether your personal data is processed, b) request information if it has been processed, c) learn the purpose of processing and whether it is used in accordance with that purpose, d) know the third parties in Türkiye or abroad to whom it is transferred, e) request correction if it is processed incompletely or inaccurately, f) request its erasure or destruction within the framework of the conditions set out in Article 7 of the Law, g) request that the operations carried out under paragraphs (e) and (f) above be notified to third parties to whom it has been transferred, h) object to a result against you arising from its analysis exclusively through automated systems, and i) claim compensation for damages if you suffer damage due to unlawful processing. You may submit your requests regarding these rights to us in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You may also submit your information and application requests by filling out the contact form on our website or by sending them to "Karadeniz Mah. Cebeci Caddesi, No:171/A Küçükköy, Gaziosmanpaşa, Istanbul / Türkiye". Our Company will conclude your requests as soon as possible depending on the nature of the request and within thirty days at the latest, free of charge for the first request. However, a fee may be charged for subsequent requests on the same subject or if the first request requires an additional cost. Our Company may accept the request and process it, or reject it in writing by stating its reasons. If the application made by following the above procedure is rejected, the response is found insufficient or the application is not answered in time, you have the right to file a complaint with the Personal Data Protection Board (the "Board") within thirty days following notification of the response and, in any case, within sixty days from the date of application. However, a complaint cannot be filed before the application procedure has been exhausted. The Board carries out the necessary examination on matters within its scope of duty upon complaint or ex officio if it learns of an alleged violation. Upon complaint, the Board examines the request and responds to the parties concerned. If no response is given within sixty days from the date of the complaint, the request is deemed rejected. If, as a result of an examination conducted upon complaint or ex officio, a violation is found, the Board decides that the unlawful practices it has identified must be remedied by the data controller and notifies the parties concerned. This decision must be implemented without delay and within thirty days of notification at the latest. In the event of damages that are difficult or impossible to remedy and clear unlawfulness, the Board may decide to suspend the processing of data or its transfer abroad. We would like to state that your data is protected with care by our Company; thank you for the trust you place in us.
This destruction policy has been prepared in order to determine the procedures and principles to be applied by Boğaziçi regarding the erasure, destruction or anonymisation of the personal data we hold in our capacity as data controller, as Boğaziçi Endüstriyel Mutfak ("Boğaziçi" or the "Company"), in accordance with the Law No. 6698 on the Protection of Personal Data and other legislation. In this context, the personal data of our employees, employee candidates, customers and all natural persons whose personal data is held by Boğaziçi for any reason is managed in compliance with the law within the framework of the Personal Data Processing and Protection Policy and this Personal Data Retention and Destruction Policy.
Direct identifiers: identifiers that, on their own, directly reveal, disclose and make distinguishable the person to whom they relate; Indirect identifiers: identifiers that, when combined with other identifiers, reveal, disclose and make distinguishable the person to whom they relate; Data subject: the natural person whose personal data is processed; Destruction: the erasure, destruction or anonymisation of personal data; Law: the Law No. 6698 on the Protection of Personal Data published in the Official Gazette dated 07.04.2016 and numbered 29677; Regulation: the Regulation on the Erasure, Destruction or Anonymisation of Personal Data published in the Official Gazette dated 28.10.2017 and numbered 30224; Board: the Personal Data Protection Board; Recording medium: any medium containing personal data processed fully or partially by automated means, or by non-automated means provided that it forms part of a data recording system; Personal Data Processing and Protection Policy: the policy, accessible at "www.bogazicimakina.com", setting out the procedures and principles for managing the personal data held by Boğaziçi; Data recording system: the recording system in which personal data is structured and processed according to certain criteria.
Personal data stored by Boğaziçi is kept in a recording medium appropriate to the nature of the relevant data and our legal obligations. The recording media used to store personal data are generally those listed below. However, some data may be kept in a medium different from those shown here due to its special characteristics or our legal obligations. In all cases, Boğaziçi acts as the data controller and processes and protects personal data in accordance with the Law, the Personal Data Processing and Protection Policy and this Personal Data Retention and Destruction Policy. a) Printed media: media in which data is kept printed on paper or microfilm. b) Local digital media: other digital media within Boğaziçi such as servers, fixed or portable disks and optical disks. c) Cloud media: media that are not located within Boğaziçi but are used by Boğaziçi, in which internet-based systems encrypted with cryptographic methods are used.
Boğaziçi takes all necessary technical and administrative measures appropriate to the nature of the relevant personal data and the medium in which it is kept, in order to store personal data securely and to prevent its unlawful processing and access. These measures include, but are not limited to, the following administrative and technical measures to the extent appropriate to the nature of the relevant personal data and the medium in which it is kept.
Boğaziçi takes the following technical measures for all media in which personal data is stored, in accordance with the characteristics of the relevant data and the medium in which it is kept:
Boğaziçi takes the following administrative measures for all media in which personal data is stored, in accordance with the characteristics of the relevant data and the medium in which it is kept:
Pursuant to Article 12 of the Law, Boğaziçi carries out internal audits on the implementation of the provisions of the Law, this Personal Data Retention and Destruction Policy and the Personal Data Processing and Protection Policy. If any deficiencies or defects in the implementation of these provisions are identified as a result of internal audits, they are remedied immediately. If it is understood during an audit or otherwise that personal data under the responsibility of Boğaziçi has been obtained by others through unlawful means, Boğaziçi notifies the data subject and the Board of this situation as soon as possible.
Personal data held by Boğaziçi is stored for the purposes and reasons specified herein in accordance with the Law and our Personal Data Policy (you can access the relevant policy at "www.bogazicimakina.com").
Personal data held by Boğaziçi is erased, destroyed or anonymised in accordance with this destruction policy upon the request of the data subject or ex officio if the grounds listed in Articles 5 and 6 of the Law cease to exist. The grounds listed in Articles 5 and 6 of the Law are as follows:
legally valid, or of another person.
it is necessary to process the personal data of the parties to the contract.
legitimate interests of the data controller.
Boğaziçi erases, destroys or anonymises the personal data it stores in accordance with the Law, other legislation and the Personal Data Processing and Protection Policy, upon the request of the data subject when the reasons requiring the processing of the data cease to exist, or ex officio within the periods specified in this Personal Data Retention and Destruction Policy. The erasure, destruction and anonymisation techniques most commonly used by Boğaziçi are listed below:
Methods of Erasure for Personal Data Kept in Printed Media Blacking out: Personal data in printed media is erased using the blacking-out method. Blacking out is carried out by cutting out the personal data on the relevant document where possible, and where this is not possible, by making it invisible using permanent ink in a way that is irreversible and cannot be read by technological solutions.
Methods of Erasure for Personal Data Kept in Cloud and Local Digital Media Secure deletion from software: Personal data kept in cloud or local digital media is deleted by a digital command in such a way that it can never be recovered. Data deleted in this way cannot be accessed again.
Methods of Destruction for Personal Data Kept in Printed Media Physical destruction: Documents kept in printed media are destroyed with paper shredders in such a way that they cannot be reassembled. Methods of Destruction for Personal Data Kept in Local Digital Media Physical destruction: This is the process of physically destroying optical and magnetic media containing personal data, such as by melting, burning or pulverising them. Data is made inaccessible through processes such as melting, burning, pulverising or passing optical or magnetic media through a metal shredder. Degaussing: This is the process of corrupting the data on magnetic media so that it becomes unreadable by exposing it to a strong magnetic field. Overwriting: Random data consisting of 0s and 1s is written at least seven times onto magnetic media and rewritable optical media to prevent the old data from being read and recovered. Methods of Destruction for Personal Data Kept in Cloud Media Secure deletion from software: Personal data kept in cloud media is deleted by a digital command in such a way that it can never be recovered, and when the cloud computing service relationship ends, all copies of the encryption keys required to make the personal data usable are destroyed. Data deleted in this way cannot be accessed again.
Anonymisation means rendering personal data impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data. Removing variables: This is the removal of one or more of the direct identifiers contained in the personal data of the data subject that could be used to identify the data subject in any way. This method may be used to anonymise personal data, and may also be used to delete information in personal data that is not consistent with the purpose of data processing. Regional hiding: This is the process of deleting information that may be distinctive in relation to exceptional data within a data table in which personal data is collectively held in anonymous form. Generalisation: This is the process of bringing together the personal data of many people and turning it into statistical data by removing distinctive information. Top and bottom coding / Global coding: For a given variable, ranges are defined for that variable and it is categorised. If the variable does not contain a numerical value, data within the variable that are close to each other are categorised. Values within the same category are combined.
Micro-aggregation: With this method, all records in the data set are first arranged in a meaningful order and then the entire set is divided into a certain number of subsets. The average of the value of the specified variable for each subset is then calculated and the value of that variable for the subset is replaced by the average value. In this way, the indirect identifiers in the data are distorted, making it difficult to associate the data with the data subject. Data swapping and perturbation: The direct or indirect identifiers in personal data are mixed with or distorted by other values, so that their link with the data subject is broken and they lose their identifying characteristics. Boğaziçi uses one or more of these anonymisation methods, depending on the nature of the relevant data, to anonymise personal data. When using these anonymisation methods, Boğaziçi may use the statistical methods of K-Anonymity, L-Diversity and T-Closeness.
Employee: Personnel data forming the basis of recruitment documents and notifications made to the Social Security Institution regarding length of service and wages. Retained for 10 years from the end of the employment relationship. Employee: Personnel data other than the personnel data forming the basis of recruitment documents and notifications made to the Social Security Institution regarding length of service and wages. Retained during the employment contract and for 10 (ten) years from the beginning of the calendar year following its termination. Employee: Data contained in the Workplace Personal Health File. Retained during the employment contract and for 30 (thirty) years from its termination. Business Partner/Solution Partner/Consultant: Identity information, contact information, financial information, voice recordings of telephone calls and data of employees of the Business Partner/Solution Partner/Consultant relating to the conduct of the commercial relationship between the Business Partner/Solution Partner/Consultant and Boğaziçi. Retained during the business/commercial relationship of the Business Partner/Solution Partner/Consultant with Boğaziçi and for 10 years from its termination pursuant to Article 146 of the Turkish Code of Obligations and Article 82 of the Turkish Commercial Code. Visitor: Name, surname, Turkish ID number and vehicle licence plate of the Visitor taken upon entry to Boğaziçi's physical premises, camera recordings and voice recordings of telephone calls. Retained for 2 years. Website Visitor: Name, surname, e-mail address and browsing activity information of the Website Visitor. Retained for 2 years. Employee Candidate: Information contained in the CV and job application form of the Employee Candidate. Retained for as long as the CV remains current, up to a maximum of 2 years. Intern (student): Information contained in the Intern's internship file. Retained during the internship relationship and for 10 (ten) years from the beginning of the calendar year following its termination. Customer: Name, surname, Turkish ID number, contact information, payment information and methods, browsing activity information, voice recordings of telephone calls,
product/service preferences, transaction history and special occasion information of the Customer. Retained for 10 years from the provision of each product/service purchased by the Customer pursuant to Article 146 of the Turkish Code of Obligations and Article 82 of the Turkish Commercial Code. Customer: Camera images and vehicle licence plate information. Retained for 2 years. Potential Customer: Identity information, contact information, financial information and voice recordings of telephone calls obtained during contract negotiations for the establishment of a commercial relationship between the Potential Customer and Boğaziçi. Retained for 2 years. Potential Customer / Customer — Custom Product Request and Technical Drawing Information: Product drawings, technical images, dimensional information and project descriptions submitted in connection with a custom product, custom dimension or custom solution request are retained for 2 years for the purpose of evaluating the request and conducting the quotation process. At the end of this period, they are erased, destroyed or anonymised in the first periodic destruction cycle. Institutions/Companies with which Boğaziçi Cooperates (Suppliers, Contract Manufacturers, Dealers/Franchisees): Identity information, contact information, financial information, voice recordings of telephone calls and data of employees of the Institutions/Companies with which Boğaziçi cooperates, relating to the conduct of the commercial relationship between them and Boğaziçi. Retained during the business/commercial relationship of the Institutions/Companies with which Boğaziçi cooperates with Boğaziçi and for 10 years from its termination pursuant to Article 146 of the Turkish Code of Obligations and Article 82 of the Turkish Commercial Code. * Where a longer period is stipulated under the legislation, or a longer period is provided for statutes of limitation, forfeiture periods, retention periods, etc. under the legislation, the periods in the provisions of the legislation are accepted as the maximum retention period.
Boğaziçi erases, destroys or anonymises the personal data for which it is responsible under the Law, the relevant legislation, the Personal Data Processing and Protection Policy and this Personal Data Retention and Destruction Policy in the first periodic destruction process following the date on which the obligation to erase, destroy or anonymise such data arises. When the data subject applies to Boğaziçi pursuant to Article 13 of the Law and requests the erasure or destruction of their personal data;
using the appropriate destruction method within 30 (thirty) days from the date of receipt of the request, explaining its reasons. For Boğaziçi to be deemed to have received the request, the data subject must have made the request in accordance with the Personal Data Processing and Protection Policy. In all cases, Boğaziçi informs the data subject about the action taken.
by stating its reasons pursuant to the third paragraph of Article 13 of the Law, and the rejection is notified to the data subject in writing or electronically within thirty days at the latest.
If all of the conditions for processing personal data set out in the Law cease to exist, Boğaziçi erases, destroys or anonymises the personal data for which the processing conditions have ceased to exist through a process carried out ex officio at recurring intervals as specified in this Personal Data Retention and Destruction Policy. Periodic destruction processes began for the first time on 30.06.2018 and are repeated every 6 (six) months.
Boğaziçi carries out the destruction operations it performs, whether upon request or ex officio in periodic destruction processes, in accordance with the Law, other legislation, the Personal Data Processing and Protection Policy and this Personal Data Retention and Destruction Policy. Boğaziçi takes a number of administrative and technical measures to ensure that destruction operations are carried out in accordance with these regulations.
Boğaziçi establishes a Personal Data Committee within its organisation. The Personal Data Committee is authorised and responsible for carrying out, or having carried out, the necessary procedures and auditing the processes for the storage and processing of data subjects' data in accordance with the law, the Personal Data Processing and Protection Policy and the Personal Data Retention and Destruction Policy. The Personal Data Committee consists of three persons: a manager, an administrative expert and a technical expert. The titles and job descriptions of the Boğaziçi employees serving on the Personal Data Committee are set out below: Title - Job Description Personal Data Committee Manager: Responsible for directing all planning, analysis, research and risk identification work in projects carried out in the compliance process with the Law; managing the processes that must be carried out in accordance with the Law, the Personal Data Processing and Protection Policy and the Personal Data Retention and Destruction Policy; and deciding on requests received from data subjects. PDP Expert (Technical and Administrative): Responsible for examining the requests of data subjects and reporting them to the Personal Data Committee Manager for evaluation; carrying out the actions relating to data subject requests evaluated and decided upon by the Personal Data Committee Manager in accordance with the Manager's decision; auditing the retention and destruction processes and reporting these audits to the Personal Data Committee Manager; and carrying out the retention and destruction processes.
Boğaziçi reserves the right to make changes to the Personal Data Processing and Protection Policy or this Personal Data Retention and Destruction Policy due to amendments to the Law, in accordance with decisions of the Authority, or in line with developments in the sector or in the field of information technology. Changes made to this Personal Data Retention and Destruction Policy are immediately incorporated into the text and explanations regarding the changes are provided at the end of the policy.
01.01.2018: The Personal Data Retention and Destruction Policy was published. *There are no earlier revisions.*
As Boğaziçi Endüstriyel Mutfak San. ve Tic. Ltd. Şti. ("Boğaziçi" or the "Company"), we attach the utmost importance to the lawful processing and protection of personal data in accordance with the Law No. 6698 on the Protection of Personal Data (the "Law"), and we act with this care in all our planning and activities. With this awareness, we present this Personal Data Processing and Protection Policy (the "Policy") for your information, both to fulfil our obligation to inform under Article 10 of the Law and to communicate all the administrative and technical measures we take in relation to the processing and protection of personal data.
The main purpose of this Policy is to provide explanations about the systems for the processing and protection of personal data in accordance with the law and the purpose of the Law, and in this context to inform the persons whose personal data is processed by our Company, in particular Company Shareholders, Company Officials, Company Business Partners, our Employee Candidates, our Visitors, Company and Group Company Customers, Potential Customers and Third Parties. In this way, the aim is to ensure full compliance with the legislation in the personal data processing and protection activities carried out by our Company and to protect all the rights of personal data subjects arising from the legislation on personal data.
This Policy has been prepared for, and will be applied to, persons whose personal data is processed by our Company by automated means or by non-automated means provided that it forms part of a data recording system, in particular Company Shareholders, Company Officials, Company Business Partners, our Employee Candidates, our Visitors, Company and Group Company Customers, Potential Customers and Third Parties. This Policy will in no way apply to legal entities or legal entity data. Our Company informs the said Personal Data Subjects about the Law by publishing this Policy on its website. The Personal Data Processing Policy for Employees will apply to our Company's employees. This Policy will also not apply where the data does not fall within the scope of "Personal Data" as defined below, or where the Personal Data processing activity carried out by our Company is not carried out by the means described above.
In this context, the personal data subjects within the scope of this Policy are as follows: Company Shareholder: Natural persons who are shareholders of the Company. Company Natural Person Business Partner: Natural persons with whom the Company has any kind of business relationship. Shareholder, Official or Employee of Company Business Partners: All natural persons, including employees, shareholders and officials of natural and legal persons (such as business partners and suppliers) with whom the Company has any kind of business relationship. Company Official: Members of the Company's board of directors and other authorised natural persons. Employee Candidate: Natural persons who have applied for a job at the Company by any means or have made their CV and related information available for review by the Company. Company Customer: Natural persons who use or have used the products and services offered by the Company, regardless of whether they have any contractual relationship with the Company. Group Company Customer: Natural persons who use or have used the products and services offered by the Company's Group Companies, regardless of whether they have any contractual relationship with the Company's Group Companies. Potential Customer: Natural persons who have requested or shown interest in using the Company's products and services, or who have been assessed in accordance with commercial practice and the rules of good faith as likely to have such an interest. Visitor: All natural persons who enter the physical premises owned by the Company for various purposes or who visit its websites for any purpose. Third Party: Other natural persons who do not fall within the scope of the Personal Data Protection and Processing Policy prepared for Company Employees or within any personal data subject category in this Policy. 1.4. Definitions The terms used in this Policy have the meanings set out below: Company / Our Company: Boğaziçi Endüstriyel Mutfak San. ve Tic. Ltd. Şti. Personal Data: Any information relating to an identified or identifiable natural person. Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Processing of Personal Data: Any operation performed on Personal Data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of Personal Data, by fully or partially automated means or by non-automated means provided that it forms part of a data recording system. Personal Data Subject / Data Subject: Persons whose personal data is processed by the Company. Group Company: The company/companies belonging to the group to which the Company is affiliated.
Data Recording System: The recording system in which personal data is structured and processed according to certain criteria. Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller. Explicit Consent: Consent relating to a specific subject, based on information and given with free will. Anonymisation: Rendering data that was previously associated with a person impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data. Law: The Law No. 6698 on the Protection of Personal Data. PDP Board: The Personal Data Protection Board.
Personal Data is processed by the Company in accordance with the procedures and principles set out in the Law and this Policy. When processing Personal Data, the Company acts in accordance with the following principles:
The Company does not process Personal Data without the explicit consent of the data subject. Personal Data may be processed without seeking the explicit consent of the data subject if one of the following conditions exists.
The Company does not process Special Categories of Personal Data without the explicit consent of the data subject. However, Personal Data other than data relating to health and sexual life may be processed without seeking the explicit consent of the data subject in cases provided for by law. Personal Data relating to health and sexual life is processed by the Company without seeking the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing, under conditions in which we are bound by a duty of confidentiality. The Company carries out the necessary procedures to ensure that adequate measures determined by the Board are taken in the processing of Special Categories of Personal Data.
Our Company may transfer the Personal Data and Special Categories of Personal Data of Personal Data Subjects to third parties in accordance with the Law, by establishing the necessary confidentiality conditions and taking security measures in line with the purposes of processing Personal Data. Our Company acts in accordance with the provisions of the Law when transferring Personal Data. In this context, in line with legitimate and lawful Personal Data processing purposes, our Company may transfer Personal Data to third parties based on and limited to one or more of the Personal Data processing conditions set out in Article 5 of the Law and listed below:
Our Company may transfer the Personal Data and Special Categories of Personal Data of Personal Data Subjects to third parties abroad by taking the necessary security measures in line with the purposes of processing Personal Data. Personal Data may be transferred by our Company to foreign countries declared by the PDP Board to have adequate protection or, where adequate protection does not exist, to foreign countries where the data controllers in Türkiye and in the relevant foreign country undertake in writing to provide adequate protection and where the PDP Board has given its permission.
By exercising due care, taking the necessary security measures and taking the adequate measures prescribed by the PDP Board, the Company may transfer the Special Categories of Personal Data of the Personal Data Subject to third parties in the following cases, in line with legitimate and lawful Personal Data processing purposes.
dress, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data), in cases provided for by law;
By exercising due care, taking the necessary security measures and taking the adequate measures prescribed by the PDP Board, the Company may transfer the Special Categories of Personal Data of the Personal Data Subject, in line with legitimate and lawful Personal Data processing purposes, to foreign countries that have adequate protection or where there is a data controller that undertakes to provide adequate protection, in the following cases.
Personal Data is processed in accordance with the law and the purpose of the Law, limited to the following purposes of the Company:
In order to ensure that the services provided to you are complete and flawless, and only to the extent appropriate to the nature of the service, Personal Data may be shared with our business and solution partners, banks, and third parties that carry out technical, logistical and other similar operations on our behalf. These third parties consist only of persons who must access the relevant information in order to provide the relevant services completely and flawlessly. In addition, your Personal Data may also be transferred, limited only to the relevant person or institution, in cases such as where it becomes necessary to share data with other third parties in order to provide the service completely and flawlessly, where it is necessary for the Company to fulfil its legal obligations, where it is expressly provided for by law, or where there is a judicial/administrative order issued in accordance with the law. Some Personal Data may be shared with advertisers only in aggregated and anonymised form together with information belonging to other users, in order to tailor advertisements to the target audience. Anonymised data is information that cannot be matched with you, our visitors/customers, and does not contain your identity information or make your identity identifiable. Your privacy is guaranteed in anonymised data.
In order to ensure compliance with Article 1 of the Law, which sets out its purpose, and Article 2, which sets out its scope, Personal Data is collected through the website, contact forms, order request forms, custom product/custom solution application areas, e-mail, telephone, the WhatsApp redirect channel, CRM records and, where necessary, physical documents. It is collected within the framework of legal grounds based on legislation, contracts, requests and demands in order to fully and accurately fulfil the responsibilities arising from the law for the purpose of achieving the purposes set out in the Policy, and is processed by the Company or by data processors appointed by the Company.
Without prejudice to the provisions of other laws regarding the erasure, destruction or anonymisation of Personal Data, the Company erases, destroys or anonymises Personal Data ex officio or upon the request of the data subject if the reasons requiring its processing cease to exist, even though it has been processed in accordance with this Law and the provisions of other laws. With the erasure of Personal Data, such data is disposed of in such a way that it can never be used again or recovered. Accordingly, Personal Data is deleted irreversibly from the media on which it is recorded, such as documents, files, CDs, diskettes and hard disks. The destruction of Personal Data means the destruction of materials suitable for data storage on which the data is recorded, such as documents, files, CDs, diskettes and hard disks, in such a way that the information cannot be recovered or used again. Anonymisation of data means rendering Personal Data impossible to associate with an identified or identifiable natural person, even if it is matched with other data.
Where provided for in the legislation, the Company retains Personal Data for the period specified in that legislation. If no period is set out in the legislation as to how long personal data must be retained, Personal Data is processed for as long as required by the Company's practices and the customs of commercial life in connection with the activity carried out by the Company when processing that data, and is then erased, destroyed or anonymised. If the purpose of processing personal data has ended and the retention periods set by the relevant legislation and the Company have also expired, personal data may be retained only for the purpose of constituting evidence in possible legal disputes, asserting the relevant right related to the personal data or establishing a defence. In determining these periods, retention periods are set based on the statutes of limitation for asserting the said right and on examples of requests previously addressed to the Company on the same subjects despite the expiry of the statutes of limitation. In this case, the retained personal data is not accessed for any other purpose, and access to the relevant personal data is provided only when it needs to be used in the relevant legal dispute. Here, too, after the
aforementioned period expires, personal data is erased, destroyed or anonymised. Detailed provisions on the Company's techniques for the retention, erasure, destruction and anonymisation of Personal Data are set out in the Company's Personal Data Retention and Destruction Policy.
In accordance with Article 12 of the Law, the Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of the Personal Data it processes, to prevent unlawful access to the data and to ensure the safekeeping of the data, and carries out or has carried out the necessary audits in this context.
The Company takes technical and administrative measures, according to technological capabilities and implementation costs, to ensure that Personal Data is processed lawfully.
The Company takes technical and administrative measures, according to the nature of the data to be protected, technological capabilities and implementation costs, to prevent the careless or unauthorised disclosure, access or transfer of Personal Data, or any other form of unlawful access.
take the necessary security measures and ensure compliance with these measures within their own organisations.
The Company takes the necessary technical and administrative measures, according to technological capabilities and implementation costs, to store Personal Data in secure environments and to prevent its destruction, loss or alteration for unlawful purposes.
In accordance with Article 12 of the Law, the Company carries out or has carried out the necessary audits within its own organisation. The results of these audits are reported to the relevant department within the scope of the Company's internal operations, and the necessary activities are carried out to improve the measures taken.
In accordance with Article 12 of the Law, the Company operates a system ensuring that, if the Personal Data processed is obtained by others through unlawful means, this situation is notified as soon as possible to the relevant Personal Data Subject and the PDP Board. If deemed necessary by the PDP Board, this situation may be announced on the PDP Board's website or by another method.
The Company observes all the legal rights of Personal Data Subjects in the application of the Policy and the Law and takes all necessary measures to protect these rights. Detailed information on the rights of Personal Data Subjects is provided in the sixth section of this Policy.
The Law attaches special importance to certain Personal Data due to the risk of causing victimisation and/or discrimination of persons when processed unlawfully. These data are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. The Company shows the utmost sensitivity to the protection of special categories of Personal Data designated as "special categories" by the Law and processed lawfully. In this context, the technical and administrative measures taken by the Company for the protection of personal data are also applied with the utmost care with regard to Special Categories of Personal Data, and the necessary audits are carried out within the Company in this regard.
In accordance with Article 10 of the Law, the Company informs Personal Data Subjects at the time Personal Data is obtained. In this context, it provides information about the identity of the Company representative, if any, the purpose for which Personal Data will be processed, to whom and for what purpose the processed Personal Data may be transferred, the method and legal basis for collecting Personal Data, and the rights of the Personal Data Subject.
Pursuant to Article 10 of the Law, the Company informs you of your rights, provides guidance on how to exercise these rights, and makes the necessary internal operational, administrative and technical arrangements for all of these. Pursuant to Article 11 of the Law, the Company explains to the persons whose Personal Data is obtained that they have the right to:
Since the following cases are excluded from the scope of the Law pursuant to Article 28 of the Law, Personal Data Subjects cannot assert their rights listed in Article (6.2.) of this Policy in the following cases:
Personal Data Subjects may submit their requests regarding their rights listed in Article (6.2.) of this Policy to the Company free of charge, together with information and documents that will establish their identity, by filling out and signing the Form available via the contact form, using the methods specified below or other methods determined by the PDP Board:
The Company concludes the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the operation requires an additional cost, the fee in the tariff determined by the PDP Board may be charged. The Company may accept the request or reject it by stating its reasons; it notifies its response in writing or electronically. If the request in the application is accepted, the Company fulfils the request.
If the application is rejected, the response is found insufficient or the application is not answered in time, the data subject has the right to file a complaint with the PDP Board within thirty days from the date they learn of the response and, in any case, within sixty days from the date of application.
A Personal Data Committee has been established within the Company by decision of the Company's senior management to manage this Policy and other policies connected and related to it. The Personal Data Committee is authorised and responsible for carrying out the necessary procedures for the storage and processing of the data of Personal Data Subjects in accordance with the law, this Policy and other policies connected and related to it. Detailed provisions regarding the persons appointed to the Personal Data Committee and their duties are set out in the Personal Data Retention and Destruction Policy published on the Company's website.
The Company reserves the right to make changes to this Policy and other policies connected and related to it due to amendments to the Law, in accordance with PDP Board decisions, or in line with developments in the sector or in the field of information technology. Changes made to this Policy are immediately incorporated into the text and explanations regarding the changes are provided at the end of the Policy.
Web sitemiz sizlere daha iyi hizmet sunulabilmesi için çerezler kullanmaktadır. Sitemizi kullanarak kvkk aydınlatma metnimizi okumuş ve kabul etmiş sayılırsınız. KVKK Aydınlatma Metni