[Company Name / Brand]  Personal Data Policy

General information about the Personal Data Law

Law No. 6698 on the Protection of Personal Data (hereinafter referred to as PDPL) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Some parts of the PDPL came into force on the date of publication, and other parts on October 7, 2016.

Information as the data controller

In accordance with Law No. 6698 PDPL and as the Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties when permitted by legislation, classified, and processed in the ways specified in the PDPL, as explained on this page.

How your personal data may be processed

According to Law No. 6698 PDPL, the personal data you share with our Company may be processed by us, entirely or partially, automatically or non-automatically as part of any data recording system, through obtaining, recording, storing, modifying, reorganizing, in short, any kind of processing performed on data. Any processing of data falling under the scope of the PDPL is considered "processing of personal data."

Purposes and legal reasons for processing your personal data

The personal data you share may be processed to

• Meet the requirements of the services we provide to our customers, in accordance with the contract and technological requirements, and to improve the products and services offered;
  
  
• Record identity, address, and other necessary information to identify the subject of the transaction, pursuant to Law No. 6563 on Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette No. 29457 dated 26.08.2015, the Distance Contracts Regulation published on 27.11.2014 in the Official Gazette No. 29188, and other relevant legislation;
  
  
• Arrange all records and documents required to support transactions in banking and electronic payment systems, electronic contracts, or paper-based processes; comply with information storage, reporting, and notification obligations stipulated by legislation and other authorities;
  
  
• Provide information to prosecutors, courts, and relevant public officials upon request and as required by legislation in matters related to public security and legal disputes;

They will be processed in accordance with Law No. 6698 PDPL and related secondary legislation. Information about third parties or organizations to which your personal data may be transferred Your personal data shared with our Company for the purposes mentioned above may be transferred to persons/organizations, primarily IdeaSoft Software Industry and Trade Inc., which provides our e-commerce infrastructure, suppliers, cargo companies involved with provided services, partner organizations used as data processors to carry out our activities, domestic/international organizations, and other third parties.

How your personal data is collected

Your personal data

• Through forms on our website and mobile applications including information such as name, surname, Turkish ID number, address, phone, business or personal email address; preferences on pages accessed by username and password, IP records of performed transactions, cookie data collected by the browser, browsing duration and details, location data;


• Verbally, in writing, or electronically through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing and call center channels;


• Obtained from individuals who share their personal data through business cards, resumes (CVs), proposals, or other means for the purposes of commercial relationship establishment, job applications, submitting proposals, either physically or virtually, face-to-face or remotely, verbally or in writing or electronically;


• Also collected and processed indirectly from different channels such as websites, blogs, contests, surveys, games, campaigns and similar (micro) websites used for such purposes, social media, e-newsletter reading or click activities, data offered by publicly available databases, and publicly shared profiles and data on social media platforms;

Your personal data obtained before the PDPL came into force

Your personal data lawfully obtained before the enforcement date of the PDPL, April 7, 2016, including membership, electronic communication consent, product/service purchases, and other methods, are also processed and maintained in accordance with the terms and conditions set forth in this document.

Transfer of your personal data abroad

Your personal data collected by any of the methods mentioned above, processed in Turkey or outside Turkey for storage purposes, will remain within the scope of the PDPL and can be transferred abroad to service intermediaries located in countries accredited by the Personal Data Protection Board and providing adequate protection for personal data, in line with the purposes of the contract.

Storage and protection of personal data

Your personal data will be confidentially stored in our Company’s databases and systems in accordance with Article 12 of the PDPL; except for legal obligations and regulations stated in this document, it will not be shared with any third parties. Our Company is obliged, pursuant to Article 12 of the PDPL, to prevent unlawful processing of personal data, block unauthorized access, and implement software and physical security measures such as access management. If it is learned that personal data has been obtained unlawfully by others, the situation will be immediately reported in writing to the Personal Data Protection Board in compliance with legal regulations.

Keeping personal data accurate and up-to-date

According to Article 4 of the PDPL, our Company has the obligation to keep your personal data accurate and up to date. For this purpose, our Customers are required to share or update their accurate and current data via the website/mobile application, to allow our Company to fulfill its legal obligations under current legislation.

Rights of the personal data owner under Law No. 6698 PDPL

Article 11 of Law No. 6698 PDPL came into force on October 7, 2016, and according to this article, the rights of the Personal Data Owner after this date are as follows: The Personal Data Owner can apply to our Company (data controller) to:

1. Learn whether personal data has been processed,
2. Request information if personal data has been processed,
3. Learn the purpose of processing personal data and whether it is used accordingly,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of incomplete or incorrect personal data,
6. Request deletion or destruction of personal data within the framework of conditions specified in Article 7 of the PDPL,
7. Request that the third parties to whom personal data has been transferred be notified of the correction, deletion, or destruction of data,
8. Object to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems,
9. Request compensation for damages arising from unlawful processing of personal data,