Arkas Turizm

Personal Data Protection Clarification Text
DATA CONTROLLER: ARKAS TURİZM SEYAHAT ACENTASI A.Ş.
Çınarlı Mah. Ankara Asfaltı Cad. No:15/101 Konak, İzmir

ARKAS TURİZM SEYAHAT ACENTASI A.Ş. (Data Controller) processes, stores, and protects the following personal data of yours:

Identity Information: Your name and surname, your parents' names, your date of birth, place of birth, gender, nationality, Turkish ID number, identity information, blood type and religion information obtained through a copy of your ID (if available), whether you are an authorized signatory, your photo.
Contact Information: Your address, phone number, email address, and if applicable, your KEP address.
Customer Information: Customer transaction details, your signature, information about the company you work for, tax information, bank account information, professional experience, job title, profession, and position details, vehicle information, information obtained during legal proceedings, tax identification number, instructions, requests, complaints, preferences, and habits related to our products and services.
Transaction Security Information: Your MAC address, log records.
Visual and Audio Information: Your photos and camera recordings.

As a result, we would like to inform you as the Data Controller in accordance with the Personal Data Protection Law No. 6698 (the Law).

Method of Collecting Personal Data and Legal Basis

Your personal data refers to "any information related to an identified or identifiable natural person," collected in both physical and electronic environments as specified in this clarification text. Your personal data is processed based on the legal grounds outlined in Article 5 of the Law, which include "as explicitly required by law," "when processing personal data of the parties to a contract is necessary for the establishment or performance of that contract," "when processing personal data is required for the data controller to fulfill their legal obligations," "when processing personal data is necessary for the establishment, use, or protection of a right," and "when processing personal data is necessary for the legitimate interests of the data controller, provided it does not infringe on the individual's fundamental rights and freedoms." If none of these legal grounds apply, your explicit consent will be requested for the processing of your personal data. You can find cases where explicit consent is required in the "Explicit Consent Form."

Purposes of Processing Personal Data

The personal data collected will be processed for the following purposes:

Management of emergency response processes,
Management of information security processes,
Conducting audits/ethical activities,
Managing access permissions,
Ensuring activities are conducted in accordance with regulations,
Managing finance and accounting operations,
Managing processes related to loyalty to company/products/services,
Ensuring physical security of premises,
Managing assignment processes,
Following up and managing legal affairs,
Conducting internal audits/investigations/intelligence activities,
Managing communication activities,
Executing business operations and audits,
Managing occupational health and safety activities,
Collecting and evaluating suggestions for the improvement of business processes,
Managing business continuity activities,
Managing logistics operations,
Managing the purchase of goods/services processes,
Managing post-sales support services for goods/services,
Managing sales processes for goods/services,
Managing production and operation processes for goods/services,
Managing customer relationship management processes,
Managing customer satisfaction activities,
Managing organization and event operations,
Managing advertising/campaign/promotion activities,
Managing risk management processes,
Conducting storage and archiving activities,
Managing corporate social responsibility and civil society activities,
Managing contract processes,
Conducting strategic planning activities,
Following up on requests/complaints,
Ensuring the safety of movable goods and resources,
Managing the marketing processes for products/services,
Ensuring the security of data controller operations,
Managing investment processes,
Providing information to authorized individuals, institutions, and organizations,
Managing management activities,
Creating and tracking visitor records.

Additionally, if you provide consent for the processing of your personal data, it will also be processed for the purposes of personalizing our products and services to meet your needs and desires, measuring your satisfaction with products and services, developing and diversifying our products and services based on your needs and desires, promoting and providing information about the activities of the company and its subsidiaries/affiliates, conducting marketing analysis, and carrying out personalized campaigns, advertisements, and promotions.

Transfer of Personal Data:

In accordance with the law and the provisions mentioned above, your personal data collected will be transferred, in compliance with the basic principles stipulated by the Law and the conditions and purposes for processing personal data specified in Articles 8 and 9 of the Law, and for the purposes stated above, to domestic and international business partners, suppliers, data controller partners, and legally authorized public institutions, organizations, and individuals with whom we have a service relationship.

Your Rights as a Personal Data Subject:

As a data subject, you can submit your requests within the scope of Article 11 of the Law, which regulates the rights of the relevant person, to the data controller by following the procedures set out in the "Communiqué on the Procedures and Principles of Application to the Data Controller." Your request can be submitted in writing with a wet signature to the address of the data controller mentioned above, via an electronic signature to [email protected], or through the email address you have previously used to contact us at [email protected]. Alternatively, you can use other methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller to reach us.

The data controller will respond to your request as soon as possible and, at the latest, within 30 (thirty) days from the date of the notification, depending on the nature of your request.

For detailed information about the processing of your personal data, you can refer to the "Personal Data Protection and Processing Policy" available at www.arkasturizm.com.

Personal Data Protection and Processing Policy

Introduction

This policy sets out the principles and rules to be followed by ARKAS TURİZM SEYAHAT ACENTASI A.Ş. (Data Controller) regarding the collection, processing, transfer, updating, and destruction of personal data, in accordance with the Law No. 6698 on the Protection of Personal Data (the Law) and relevant national legislation.

Owner of the Policy

The owner of the Personal Data Protection and Processing Policy is the Data Controller, ARKAS TURİZM SEYAHAT ACENTASI A.Ş.

Purpose

The purpose of this policy is to provide explanations regarding the personal data processing activities and the rules adopted for the protection of personal data by the Data Controller. In this context, it aims to inform and ensure transparency for individuals whose personal data is processed by our company, including our business partners, current and prospective employees, current and potential customers, company shareholders, visitors, and third parties.

Scope

The scope of this policy includes the shareholders and partners of the Data Controller, employees, prospective employees, interns, subcontractors, suppliers, current and potential customers, visitors, and third parties whose personal data are processed.

Update

The Personal Data Protection and Processing Policy is reviewed and recorded annually, regardless of the need for changes due to corporate or legal requirements. The most up-to-date version is published on the data controller's website.

Definitions

The definitions not mentioned here will be used as defined in the Law and secondary regulations.

Explicit Consent: Consent given freely, based on being informed, for a specific subject.

Anonymization: The process of making personal data unidentifiable and unlinkable to any identifiable or identifiable natural person, even if combined with other data.

Obligation to Inform: The responsibility of the Data Controller to inform individuals whose data is processed, regarding who will process their data, for what purposes, and on what legal grounds, and to whom the data may be transferred for what purposes.

Data Subject: The natural person whose personal data is being processed.

Personal Data: Any information related to an identified or identifiable natural person. This includes information such as a person's name, surname, date of birth, place of birth, and any information regarding their physical, familial, economic, and other characteristics such as name, phone number, vehicle license plate, social security number, and passport number.

Processing of Personal Data: Any operation performed on personal data, whether automatically or non-automatically as part of a data recording system, including obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, receiving, making available, restricting, or preventing the use of the data.

Special Categories of Personal Data: Data related to a person’s race, ethnicity, political opinions, philosophical beliefs, religion, sect, or other beliefs, appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Data Processor: A natural or legal person who processes personal data on behalf of the Data Controller, based on the authority granted by the Data Controller. These individuals process personal data within the instructions given and are authorized by the Data Controller through a personal data processing agreement.

Data Controller: A natural or legal person who determines the purposes and methods of personal data processing and is responsible for establishing and managing the data recording system.

Data Controllers Registry (VERBİS): A registration system that must be maintained by the Personal Data Protection Authority (the Authority) for Data Controllers to register, as required by the Personal Data Protection Law No. 6698.

Roles and Responsibilities

Within the scope of the Personal Data Protection and Processing Policy, four complementary roles have been defined.

Data Officer

There are two "Data Officers" assigned for the Data Controller, one as the primary and the other as a backup. The responsibilities of the Data Officer are as follows:

The Data Officer, together with all employees of the Data Controller, is responsible for creating a detailed personal data processing inventory and coordinating related activities.
The Data Officer follows up on changes and regulations in data processing activities and ensures the inventory is kept up-to-date.
The Data Officer communicates any potential changes to the Data Controller's Contact Person.
The Data Officer carries out the tasks and operations specified in the company's policies, procedures, and instructions.

Data Controller Contact Person

Each Data Controller has a designated "Data Controller Contact Person." The responsibilities of the Data Controller Contact Person are as follows:

The Data Controller Contact Person must be aware of all processes and activities related to the protection of personal data within the assigned Data Controller.
Represent the Data Controller in official and internal audit processes, take necessary actions, and ensure they are concluded.
Respond to requests from the relevant individuals.
In case of a data breach, inform company management, the Data Protection Consultation Group, and the Legal Department.
Follow up on any changes and regulations in data processing activities reported by the Data Controller and related departments, together with the Data Officer, and ensure the inventory is kept up to date.
If there are any changes in the registered information in VERBİS, report the changes to the Authority via VERBİS within seven days from the date the changes occurred.
Facilitate communication with the Authority.
In case of a data breach, ensure that legal notifications are made properly and in accordance with the procedure.
Carry out tasks and operations specified in company policies, procedures, and instructions.

Data Controller Senior Management

The responsibility of the Data Controller Senior Management (such as the Chairman of the Board, CEO, etc.) is to supervise that the Data Controller Contact Person performs their duties as outlined by the law
Changes and appointments of the Data Controller Contact Person and the Data Officer are made by the Data Controller Senior Management upon the termination of their employment contract and are reported to the Data Protection Consultation Group.

1. Data Protection Consultation Group

The KVK Advisory Group is responsible for preparing, updating, and auditing the applicable KVKK policies and procedures for the Data Controller.
They monitor updates and changes in the relevant legislation related to the law.
They take necessary actions in case of situations requiring updates to administrative and technical measures.
Providing KVK consultancy across Arkas Group companies.
They provide consultancy regarding actions related to inspections, individual notifications, complaints, etc. under the legislation, which will be reported to them by the Data Controller Contact Persons.

Approval

The policy prepared by the KVK Advisory Group is approved by the relevant senior management representatives on behalf of the Data Controller.

Persons Whose Personal Data is Processed

The personal data of real persons such as job candidates, employees, individuals subject to news, shareholders/partners, potential buyers of products or services, interns, supplier employees, supplier representatives, individuals receiving products or services, parents/guardians/representatives, visitors, etc. are processed.

Data Categories

Personal data such as identity, contact, location, personal status, legal transactions, customer transactions, physical space security, transaction security, risk management, finance, professional experience, marketing, visual and auditory recordings, philosophical beliefs, religion, sect and other beliefs, membership in associations, health information, criminal convictions and security measures, and biometric data are processed in accordance with the purpose of personal data processing.

Activities and Purposes Related to the Processing and Sharing of Personal Data

Personal data will be processed for the following purposes, in accordance with the activities related to the processing and sharing of personal data: managing emergency response processes, implementing information security processes, managing employee satisfaction and engagement processes, fulfilling contractual and legal obligations for employees, managing employee benefits and rights processes, conducting audit/ethical activities, conducting training activities, managing access rights, ensuring compliance with regulations in activities, managing financial and accounting tasks, ensuring physical space security, managing assignment processes, monitoring and managing legal affairs, conducting internal audits/investigations/intelligence activities, managing communication activities, planning human resources processes, conducting business activities/monitoring, managing occupational health and safety activities, receiving and evaluating suggestions for improving business processes, ensuring business continuity, conducting logistics activities, managing goods/services procurement processes, managing goods/services sales processes, managing goods/services production and operation processes, organizing and event management, managing performance evaluation processes, conducting advertising/campaign/promotion processes, managing risk management processes, performing storage and archiving activities, conducting social responsibility and civil society activities, managing contract processes, conducting strategic planning activities, tracking requests/complaints, ensuring the security of movable property and resources, implementing salary policies, ensuring the security of the data controller's operations, managing work and residence permit processes for foreign employees if applicable, providing information to authorized persons, institutions, and organizations, and managing management activities.

Your personal data will be processed in accordance with the basic principles set forth by the Law and in compliance with the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, as well as for the purposes listed above, and may be transferred domestically and internationally to our business partners, suppliers, Arkas Holding A.Ş. and its affiliated companies/organizations, and legally authorized public institutions, organizations, and individuals.

Measures Taken When Transferring Data to Third-Party Service Providers

Personal data protection clauses are added to contracts and annexes with third-party service providers, a separate confidentiality agreement is made, additional undertakings or protocols are established, and the relevant service providers are audited to ensure that personal data is properly protected. Additionally, a "Framework Data Transfer Agreement" is arranged between group companies, subsidiaries, and affiliates to regulate the sharing of personal data within the group.

Data Protection Policies and Procedures

This policy contains the general terms and conditions for the protection and processing of personal data within the Data Controller’s organization.

Personal Data Retention and Destruction Policy: This policy contains the rules and procedures related to the retention and destruction processes of personal data within the Data Controller's organization.
Processing and Protection of Special Category Personal Data Policy: This policy includes the rules and procedures regulating the conditions and methods for processing special category personal data within the Data Controller’s organization.
Employee Personal Data Protection and Processing Policy: This policy outlines the rules and procedures for the protection and processing of personal data belonging to employees within the Data Controller’s organization.
Information Systems General Standards and Security Policy: This policy aims to ensure the security and confidentiality of information and data in all commercial and operational electronic, written, or other environments, and defines the general principles for the processing of personal data related to employees.
Informing and Obtaining Explicit Consent Texts: This ensures that individuals are informed and that personal data processing activities are conducted in compliance with the Law.
Internal Training: Employees are informed about the Law through internal training, aiming to increase awareness.
Management of Data Subject Requests Procedure: This procedure establishes the rules and conditions for investigating, responding to, and taking necessary actions regarding requests from data subjects within the Data Controller’s organization.
Audit of Personal Data Processing Activities: Personal data processing activities are regularly audited within the Data Controller’s organization to ensure compliance with the relevant laws and regulations.

Risk Analysi

The risk findings resulting from regular audits conducted by the Internal Audit Department are evaluated with the KVK Advisory Group. Information regarding the actions to be taken or processes that need to be changed is provided to the senior management of Arkas Holding A.Ş. and its affiliated companies, and the necessary measures are ensured to be taken by the relevant Data Controller.

Non-Policy Situation

In the event that different practices are identified outside of what is described in this policy, the individuals who detect the discrepancies will provide written information to the KVK Advisory Group, with the support of the Data Controller Contact Person and Data Officers.

Principles of Personal Data Processin

Personal data is processed in accordance with the general principles and provisions set out in the legislation to ensure compliance with the Law. In this context, the Data Controller acts in accordance with the following principles for the processing of personal data in compliance with the Law and related legislation:

Processing Personal Data in Compliance with Law and the Principle of Integrity
The Data Controller acts in accordance with the law and the principle of integrity in the activities related to the processing of personal data.

Ensuring the Accuracy and Up-to-Date Status of Personal Data
The Data Controller ensures that the personal data they process is accurate and, when necessary, kept up to date, taking into account the fundamental rights of data subjects and their legitimate interests. The Data Controller establishes the necessary systems to take the required measures in this regard.

Processing for Specific, Explicit, and Legitimate Purposes
The Data Controller determines the purpose for which personal data will be processed and informs the data subjects of these purposes before processing the personal data. Personal data is not processed for purposes other than those specified and legitimate, in accordance with the law.

Being Relevant, Limited, and Proportional to the Purpose for Which It Is Processed
The Data Controller processes personal data in a manner that is suitable for the achievement of the determined purposes, avoiding the processing of personal data that is unrelated or unnecessary for the purpose. In this context, proportionality requirements are considered, and personal data is not used for purposes other than those initially specified.

Storing Personal Data for the Period Required by Relevant Legislation or for the Purpose for Which It Was Processed
The Data Controller first determines whether the relevant legislation specifies a period for storing personal data. If a period is specified, the Data Controller complies with that period. If no period is specified, personal data is retained only for the duration necessary to fulfill the purpose for which it was processed.

Building Entries and Personal Data Processing Activities Within the Building, and Network and Website Users

The Data Controller processes personal data through security camera surveillance and the tracking of guest entries and exits within the Data Controller’s buildings and facilities for security purposes. By using security cameras and recording guest entries and exits, the Data Controller carries out personal data processing activities.

At the entrances of buildings and facilities, as well as within the premises, the Data Controller collects video recordings of visitors and all relevant individuals through a camera surveillance system. The data includes personal information such as first and last names, national ID number, driver’s license number, passport number, employee ID number, title, field of work, gender, company name, entry and exit dates and times, and vehicle license plate information, which are kept in a visitor log.

The Data Controller conducts video surveillance activities for the purpose of improving the quality of the services provided, ensuring reliability, safeguarding the security of the Data Controller, customers, and third parties, and protecting the interests of customers regarding the services they receive.

The video surveillance activities conducted for security purposes are carried out in compliance with the regulations of the Law and Law No. 5188 on Private Security Services, as well as other relevant legislation.

In compliance with Article 12 of the Law, necessary technical and administrative measures are taken to ensure the security of the personal data obtained through video surveillance activities.

For the purpose of ensuring security and for the purposes outlined in this policy, internet access may be provided to visitors who request it during their stay at the building or facilities. In this case, internet access logs are recorded in accordance with Law No. 5651 on the Regulation of Publications Made on the Internet and Combating Crimes Committed by These Publications, and the relevant provisions of the related regulations. These logs are processed only when requested by authorized public institutions or organizations or during audit processes conducted within the Data Controller’s organization to fulfill the related legal obligations.

Access to the digitally recorded and stored logs is limited to a restricted number of personnel from the Information Security Unit.

The obtained log records are stored with a timestamp to ensure their immutability, and they are preserved with access restricted to a limited number of Information Security Unit personnel.

Processing of Customer and Business Partner Data

Personal data may be processed to communicate with customers in writing or verbally, in line with the purposes mentioned above.

Due to the relationship arising from the contract, personal data related to existing and potential customers and business partners (in the case of a business partner being a legal entity, personal data related to the authorized representative of the business partner) may be processed for the establishment, implementation, and termination of a contract without prior consent. Before the contract is made, during the contract initiation phase, personal data may be processed for purposes such as preparing an offer, preparing a purchase form, or addressing the individual’s requests related to the execution of the contract.

Personal data may also be processed for advertising purposes, market and public opinion research, but only when the purpose of collecting the information aligns with these objectives. The individuals concerned are informed about the use of their data for advertising purposes.

Due to legal obligations or because it is explicitly foreseen by law, personal data may be processed without additional consent for data processing activities, when explicitly stated in the relevant legislation or to fulfill a legal obligation specified by law. The type and scope of the data processing activity must be necessary for the legally permitted data processing activity and must comply with the relevant legal provisions.

Special categories of personal data are processed by the institution under sufficient precautions, as determined by the institution and in accordance with the provisions of the Law. Special categories of personal data, excluding health and sexual life data, are processed with the explicit consent of the data subject. If explicit consent is not available, data may be processed in accordance with the exceptions provided in the Law.

Processing of Employee and Job Candidate Data

The rules and procedures regulating the conditions and methods for the protection and processing of personal data of employees within the Data Controller's organization are included in the "Employee Personal Data Protection and Processing Policy."

Additionally, the collection and processing of personal data of employees are mandatory throughout the process of establishing, executing, and terminating the employment contract. For these processes, the employees' explicit consent may not be required. The personal data of potential job candidates is also processed during job applications. If the job application is rejected, the personal data obtained during the application is retained for the retention period, and after this period, it is deleted, destroyed, or anonymized.

Personal data related to employees may be processed without additional consent for the purpose of fulfilling legal obligations clearly stated in the relevant legislation or to comply with legal requirements.

Personal data of employees may be processed without explicit consent when the Data Controller has a legitimate interest. When personal data is processed based on the legitimate interest of the Data Controller, the proportionality of this processing is assessed to ensure that the legitimate interest does not violate a right of the employee that should be protected.

Special categories of personal data are processed only under specific conditions. Data related to race and ethnic origin, political views, religion, philosophical beliefs, sect or other beliefs, appearance, membership in associations, foundations or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data, are defined as special categories of personal data. These special categories of data can only be processed if the employee's explicit consent is obtained and necessary administrative and technical measures are taken.

The following cases constitute exceptions to this rule, and in these cases, special categories of personal data can be processed without the employee’s explicit consent: Personal data related to the health and sexual life of employees, as defined in the law; personal data related to the health and sexual life of employees may be processed by individuals or authorized institutions who are under the obligation of confidentiality and for the purpose of protecting public health, providing preventive medicine, medical diagnosis, treatment, and care services, planning and managing health services, and financing them.

Conditions for Processing Personal Data

Detection and Processing of Personal Data

Under the law, personal data is defined as "any information relating to an identified or identifiable natural person." The concept of personal data is not limited to information such as name, surname, place of birth, and date of birth that allows individuals to be recognized and identified, but also includes all physical, social, cultural, economic, and psychological information about individuals.

In addition to identity information, other details such as citizenship number, tax number, passport number, social security number, driver's license number, vehicle license plate, home address, work address, email address, phone number, fax number, curriculum vitae, photo, video, genetic information, blood type, criminal history, and criminal record are all considered personal data, as they allow an individual to be identified or identifiable. These types of information fall under the scope of personal data protection.

In line with this definition, the Data Controller, along with its business partners, employees, customers, and third parties, determines whether the data they collect falls under the category of personal data and processes this data in accordance with the rules set out in the law.

The processing of personal data includes all types of actions performed on data, including obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, making available, classifying, or preventing the use of data, whether fully or partially automated, or through non-automated means as part of any data recording system.

Exceptions

The Data Controller processes personal data with the explicit consent of the data subjects in accordance with the Law. However, personal data processing is possible without the explicit consent of the data subject under any of the following conditions:

Explicit Provision in Laws: When explicitly foreseen in laws (e.g., tax law, labor law, commercial law, etc.).
Directly Related to the Establishment or Performance of a Contract: When the processing of personal data of the parties to the contract is necessary for the establishment or performance of a contract (e.g., employment contracts, sales contracts, transportation contracts, work contracts, etc.).
Inability to Express Consent Due to Physical Impossibility: In cases where the individual is unable to express their consent due to physical impossibility or when the consent is legally invalid, and the processing of data is necessary to protect the life or bodily integrity of the individual or another person.
Necessary for Legal Obligation: When the processing is required to fulfill the legal obligations of the data controller (e.g., financial audits, compliance with security regulations, sector-specific regulations, etc.).
Personal Data Made Public by the Data Subject: When the data subject has made their personal data public (e.g., voluntarily sharing personal information with the public).
Necessary for the Establishment, Use, or Protection of a Legal Right: When the processing of data is necessary for the establishment, exercise, or protection of a legal right (e.g., for filing a lawsuit, registration procedures, real estate transactions, etc.).
Necessary for Legitimate Interests of the Data Controller: When it is necessary for the legitimate interests of the data controller, provided that it does not violate the fundamental rights and freedoms of the data subject.

Processing of Special Categories of Personal Data

Under the Law, certain personal data is classified as "special categories of personal data." The Data Controller does not process such data without the explicit consent of the data subject. Explicit consent refers to "consent that is informed, based on specific information, and given voluntarily."

The Law categorizes the following data as special categories of personal data: a person's race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing and appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, security measures, and biometric and genetic data. The list of these data types is exhaustive as defined in the Law and cannot be extended through interpretation.

The Data Controller will also take adequate measures, as determined by the Personal Data Protection Board (the Board), to protect the processing of special categories of personal data.

According to the Law, the Data Controller may only process special categories of personal data under the following conditions:

With the Explicit Consent of the Data Subject.
Under a Legal Obligation (For personal data other than health and sexual life, such data may be processed without explicit consent in situations explicitly foreseen in laws).
For Public Health Reasons, including the planning, management, and financing of health services (such data may be processed by individuals or authorized institutions under confidentiality obligations for purposes such as protecting public health, preventive medicine, medical diagnosis, treatment, care services, and the planning, management, and financing of health services).

Conditions for Transferring Personal Data

The Data Controller, by taking the necessary security measures in line with the lawful purposes of personal data processing, may transfer personal data to third parties with the explicit consent of the data subject or in compliance with the conditions set forth in Articles 5/2 and 6/3 of the Law (legal grounds). Additionally, the Data Controller may transfer personal data to third parties without explicit consent, in accordance with the data processing conditions stipulated in the Law.

The Data Controller will take the necessary administrative and technical measures to ensure the transfer of data without explicit consent is carried out in accordance with the restrictions set by the Law.

The Data Controller may transfer personal data to foreign countries that have been declared by the Personal Data Protection Board to have adequate protection, or if there is no adequate protection, to foreign countries where both the data controllers in Turkey and the foreign country provide a written commitment for adequate protection, and where the Board has granted permission for the transfer.

Obligations of the Data Controller

Obligation to Inform the Data Subjec

The Data Controller is required to inform personal data subjects about the following aspects during the collection of personal data:

Under this obligation, the Data Controller provides information to the concerned individuals with the information notice they have prepared. The information must be provided at the time of the first contact with the individual.
If personal data is not obtained from the individual directly, the Data Controller must inform the individual within a reasonable time frame after obtaining the personal data, especially if the data will be used for communication purposes or transferred to third parties. In such cases, the information must be provided at the time of the first communication or, if applicable, no later than the first transfer of personal data.

Obligation to Respond to the Data Subject's Requests

Data subjects can request information from the Data Controller in writing or by other methods specified by the Authority.

The Data Controller will respond to data subjects' requests regarding their rights and will provide the necessary information as stipulated in Article 13 of the Law. The Data Controller also sets up procedures for administrative and technical regulations.

Data subject rights include:

Learning whether their personal data is processed,
Requesting information about personal data processing if data has been processed,
Learning the purposes of processing and whether the data is being used appropriately,
Knowing the third parties to whom their personal data has been transferred, both inside and outside the country,
Requesting correction if personal data is incomplete or incorrect,
Requesting deletion or destruction of personal data as per the relevant legislation,
Requesting notification of changes in their personal data processing to third parties, if applicable,
Objecting to decisions made exclusively based on automated processing of personal data,
Requesting compensation for damages incurred due to unlawful processing of personal data.

The Data Controller processes requests sent by written or secure electronic signature or by using the "Application Form" available on the website. If the Authority determines other application methods, those methods will also be accepted.

The Data Controller responds to the request as quickly as possible, and no later than 30 (thirty) days. The Data Controller can accept the requests and carry out the necessary actions or reject them with a reason.

In case of rejection or unsatisfactory response, or failure to respond, the data subject can file a complaint with the Authority within 30 (thirty) days after learning of the response, or within 60 (sixty) days from the application date.

Obligation to Ensure Personal Data Security

The Data Controller takes necessary technical and administrative measures to prevent unlawful processing and access to personal data and to ensure its protection.

The Authority may introduce detailed regulations regarding data security in the future, so the Data Controller will ensure compliance with these regulations and ensure the security of personal data.

The Data Controller establishes systems to monitor the functioning of technical and administrative measures and conducts necessary audits. The results of these audits are reviewed by the relevant departments within the Data Controller, and necessary measures are taken.

If personal data is accessed unlawfully, the Data Controller must notify the Authority within 72 hours (seventy-two) of becoming aware of the breach. After identifying the affected individuals, notification is made directly to them, if possible, or through appropriate methods such as publishing it on the Data Controller's website.

Technical and Administrative Measures to Ensure Lawful Data Processing

The Data Controller analyzes all processes related to personal data processing within the company and stores them in the personal data processing inventory. All activities, from data collection to deletion, are subject to a legality review.

Personal data processing activities are monitored by technical systems. In case of unlawful processing, the concerned parties are notified, and the deficiencies or legal violations are corrected.

The Data Controller educates and informs employees about personal data protection laws and the lawful processing of personal data.

Contracts and documents governing legal relationships between the Data Controller and its business partners, employees, and customers include provisions that prohibit unlawful processing, disclosure, or use of personal data.

Each department's activities are evaluated for compliance with the conditions set forth in the Law, and procedures, administrative measures, and training programs are established to ensure compliance.

Measures to Prevent Unlawful Access to Personal Data

The Data Controller takes necessary administrative and technical measures to prevent unlawful access, disclosure, viewing, or transfer of personal data. The Data Controller develops mechanisms for this and educates the relevant departments to ensure compliance with these obligations.

Personal Data Retention and Destruction Policy

Purpose

This Personal Data Retention and Destruction Policy (Policy) has been prepared in accordance with Article 5 of the "Regulation on Deletion, Destruction, or Anonymization of Personal Data" in line with the Data Controller's (Company's) personal data processing inventory.

The purpose of this Policy is to establish the principles of the Company's personal data retention and destruction practices in order to comply with the laws and secondary regulations to which the Company is subject.

This Policy has been prepared to define the procedures and principles regarding the activities of data retention and destruction carried out by the Company.

This Policy adheres to the following principles set out in the Law No. 6698 on the Protection of Personal Data (the Law). According to the Law, the processing of personal data must:

Be lawful and in accordance with the principles of fairness,
Be accurate and, when necessary, kept up to date,
Be processed for specified, explicit, and legitimate purposes,
Be relevant, limited, and proportionate to the purposes for which they are processed,
Be retained for the period prescribed by the relevant legislation or as necessary for the purpose for which they were processed.
This Policy applies to all physical and electronic documents/media, including originals and copies, created or maintained within the scope of the Company’s activities. The applicable legislation may require the Company to retain certain records for specific periods. Non-compliance with these retention periods may expose the Company to fines and sanctions, hinder the administration of justice, result in the loss of evidential qualities of legal documents, and/or significantly damage the Company’s position in legal processes. Therefore, this Policy:
Includes an "APPENDIX-A / Retention and Destruction Periods Table" specifying the retention periods determined by the applicable legislation and processes.
Also includes an "APPENDIX-B / Table of Persons Involved in the Retention and Destruction Process," which defines which individuals/departments within the Company are responsible for and involved in the retention and destruction processes and their respective duties.

Company employees are responsible for fully understanding and implementing this Policy.

Definitions
Unless they are proper nouns and are defined separately within the Policy, the terms listed below have the meanings as defined:

Explicit Consent Recipient Group	Refers to consent that is based on being informed and freely given, related to a specific matter. Refers to the category of natural or legal persons to whom personal data is transferred by the Data Controller.
Active Records	It refers to the records that are currently being used for the operation, administration, and management of the Company.
Inactive Records	Inactive records; records that are not in use, but have not yet reached their retention period because they may need to be processed later.
Anonymization	It refers to the process of making personal data unidentifiable to any specific or identifiable individual, even when combined with other data. It refers to natural persons working within the data controller's organization.
De-magnetization Electronic Environment Non-Electronic Environment	It refers to the process of passing magnetic media through a special device, exposing it to a high-value magnetic field, which causes the data on it to become unreadable. An electronic environment refers to settings where data is stored with minimal human intervention, and logical or arithmetic operations are applied. In these environments, operations such as data modification, deletion, retrieval, or transfer are performed using automatic or partially automated methods. The processing through non-automatic methods, connected to a data recording system, refers to the activities of processing manually prepared data, which facilitates access and understanding.
Physical Destruction (For Electronic Data) Service Providers	It refers to the physical destruction of optical media and magnetic media, such as melting, burning, or pulverizing them. It refers to natural or legal persons engaged in commercial activities to sell products or services to the Data Controller, as well as natural and legal persons acting as intermediaries for these services.
Two-Factor Authentication Secondary Legislation	It refers to an authentication system consisting of the combination of a person's username and password with an external authentication system (such as a mobile phone, personal question, cryptographic key, etc.). According to the law, it means any regulation, circular, communiqué, policy decision, or similar administrative decision or general opinion issued or taken by the Personal Data Protection Authority.
Relevant Person	It refers to the real person whose personal data is processed.
Relevant Users	It refers to the individuals who process personal data within the Data Controller organization or under the authority and instructions received from the Data Controller, excluding the person or unit responsible for the technical storage, protection, and backup of the data.
	It refers to any or all of the processes of deletion, destruction, and/or anonymization. It refers to the Personal Data Protection Law No. 6698.
	It refers to processes such as crossing out, painting over, frosting, or starring the entirety of personal data in a way that it can no longer be associated with an identified or identifiable real person.
Record Environment	It refers to any environment where personal data is processed through fully or partially automated means, or through non-automated means as part of any data recording system.
Personal Data	It refers to any information related to an identified or identifiable real person.
Registered Electronic Mail (KEP) Personal Data Processing Inventory	It refers to the qualified form of electronic mail that provides legal evidence regarding the use of electronic messages, including their sending and delivery. It refers to the inventory created by the Data Controller in relation to personal data processing activities carried out based on their business processes. This inventory associates the purposes of personal data processing, legal grounds, data categories, the recipient group, and the group of data subjects, detailing the retention periods necessary for the purposes for which the personal data is processed, personal data to be transferred to foreign countries, and the security measures taken regarding data security.
Board	It refers to the Personal Data Protection Board.
Authority	It refers to the Personal Data Protection Authority.
KVK Consultation Group Special Categories of Personal Data	It refers to the company employees who carry out the completion of the compliance project with the Law within the company and the subsequent consulting services. It refers to data related to a person's race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
Periodic Destruction	It refers to the process of deletion, destruction, or anonymization that will be carried out automatically at recurring intervals, as specified in the Personal Data Retention and Destruction Policy, when all conditions for processing personal data mentioned in the Law are no longer applicable.
	It refers to this Personal Data Retention and Destruction Policy.
Retention and Destruction Periods Table	It refers to the "Retention and Destruction Periods Table" found in Appendix A.
	It is a file transfer protocol that uses the cryptographic network protocol SSH for transferring files. It refers to the process of making personal data completely inaccessible and irretrievable for the relevant users.
	It refers to the Data Controller.
Overwriting	It refers to the process of writing random data consisting of 0s and 1s at least seven times on magnetic media and rewritable optical media to prevent the recovery of old data. The Data Controllers Registry (VERBIS) is a registration system where data controllers are required to register and declare information related to their data processing activities.
Data Processor	It refers to the real or legal person who processes personal data on behalf of the Data Controller based on the authority granted by the Data Controller.
Data Recording System	It refers to the recording system in which personal data is processed by being structured according to specific criteria.
Data Controller Data Controller Contact Person Data Officer	It refers to the real or legal person who determines the purposes and means of processing personal data, and is responsible for the establishment and management of the Data Recording System. For real and legal persons established in Turkey, it refers to the individual notified during the registration process to communicate with the Authority regarding the obligations under the Law and secondary regulations issued based on this Law, as indicated by the Data Controller. For real and legal persons not established in Turkey, it refers to the representative of the Data Controller. It refers to the company employee appointed by the Data Controller, who creates, maintains, and updates the company’s personal data inventory in compliance with the Law, and communicates the necessary changes to the Data Controller Contact Person.
Destruction	It refers to the process of making personal data completely inaccessible, irretrievable, and unusable by anyone in any way.
	It refers to the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, published in the Official Gazette on October 28, 2017, and which entered into force on January 1, 2018.

It will be accepted that definitions not included here will be used with the meanings specified in the Law and secondary regulations.

Scope
This Policy applies to the entire Company and regulates the necessary obligations. Personal data processed by the Company concerning all natural persons are within the scope of this Policy. This Policy will be applied to all recording environments where the personal data owned or managed by the Company is processed, as well as all data processing activities.
When the Company processes personal data as the Data Controller, it acts in accordance with the provisions in this Policy.
When the Company processes personal data as a Data Processor on behalf of another party, it complies with the provisions in this Policy and, where applicable, follows the instructions in any contract signed with the relevant third party that does not conflict with the Policy.
The department manager, the Data Controller Contact Person, and the Data Officer are responsible for the implementation of the Policy and ensuring compliance with the Policy.

Reasons for the Storage and Destruction of Personal Data
Our Company:

The Tax Procedure Law No. 213,
The Enforcement and Bankruptcy Law No. 2004,
The Labor Law No. 4857,
The Turkish Penal Code No. 5237,
The Social Security and General Health Insurance Law No. 5510,
The Law No. 5651 on the Regulation of Publications on the Internet and Fighting Crimes Committed through These Publications,
The Turkish Commercial Code No. 6201,
The Turkish Obligations Code No. 6098,
The Occupational Health and Safety Law No. 6331,
The Personal Data Protection Law No. 6698, and the related regulations,
Other regulations published under these laws,
Inspections by the Ministry of Labor and Social Security and the Social Security Institution,
Statistical studies,
Presentation for court and expert reviews,
Upon request by local law enforcement and organized industrial zone offices,
may process, store, and record personal data for deletion when necessary.
The purposes for processing personal data that require storage include: managing human resources processes, ensuring corporate communication, maintaining company security, conducting statistical studies, fulfilling work and transactions resulting from signed contracts and protocols, ensuring the fulfillment of legal obligations as required or mandated by regulations, establishing communication with real/legal persons in business relationships with the company, managing occupational health and safety processes, running information systems processes, keeping visitor, camera, and meeting records, processing customer data, managing supply processes, conducting accounting and finance processes, monitoring travel processes, and processing postal, cargo, and shipment records.

Recording Environments

Physical Records
Physical environments, such as written, printed materials, and manual data recording systems (survey forms, visitor logbooks), consist of physical records, paper-based records, photographs, contracts, paper, microfiche, and similar media.
Inactive records are sent to the Company's archives.
Electronic Records
Personal data contained in various media such as audio recordings, photographs, videos, and audiovisual media can be stored in secure electronic environments that prevent unauthorized third-party access and processing, ensuring that the data is accessible only to those who need to process accurate and up-to-date personal data.

Servers (domain, backup, email, database, web, file sharing, etc.),
Software (office software, portal, etc.),
Information security devices (firewall, intrusion detection, blocking, log files, antivirus, etc.),
Backup cartridges,
Personal computers (desktop, laptop),
Mobile devices (phone, tablet, etc.),
Optical disks (CD, DVD, etc.),
Removable storage devices (USB, memory card, etc.),
Printers, scanners, photocopiers, and other electronic data recording media can be listed.

Adequate protective measures should be taken, processes should be established, and they should be implemented by the Company to ensure that electronic records are protected against being lost, altered, and unauthorized destruction, and to ensure they remain complete, accurate, and legible during the storage process.Storage and Destruction Periods, Periodic Destruction

6.1. Appendix A includes the specific processes and their retention periods. Appendix B contains information about the individuals/units involved in these processes and their responsibilities.
6.2. In the context of this Policy, the storage calendar begins at the end of the calendar year in which the record was created. All records whose retention period has expired will be destroyed twice a year. The first periodic destruction occurs at the end of the calendar year, and the second occurs at the end of June each year. The period between the periodic destructions should not exceed six months. The personal data will be destroyed in the period that is closest to the date when the purpose of processing the personal data is no longer valid. (For example, if a record was created in March 2010 and needs to be kept for seven years, it will be destroyed on June 30, 2017; if the record had been created in November 2010, it would need to be destroyed on December 31, 2017.)

Destruction

Records must be destroyed in the following cases:
The conditions under which personal data will be deleted, and the actions to be taken when these conditions occur, will be determined by the Senior Management, Data Controller Contact Person, and the KVK Advisory Group, based on the specific circumstances of the case, the Law, Regulations, and Secondary Legislation. These actions will be documented in the company's data inventory with the most up-to-date version, including the retention periods.

PROCESS

RETENTION PERIOD

DESTRUCTION PERIOD

Management of Occupational Health and Safety Processes

10 years from the termination of the employment relationship