Hakkımızda

KVKK

OUR PERSONAL DATA PROTECTION AND PROCESSING POLICY

The Personal Data Protection Law No. 6698 (KVKK) regulates the procedures that relevant parties must comply with regarding the processing and protection of personal data, primarily to protect the privacy of private life and the fundamental rights and freedoms of individuals. Our company is aware of the procedures and responsibilities it must comply with under the KVKK. The confidentiality and security of personal data is of great importance to our company. Ensuring compliance with the KVKK and meeting the necessary requirements is one of our priorities, along with implementing a data protection and processing policy that meets international standards. In this regard, our “Personal Data Protection and Processing Policy” (“KVK Policy”) defines the fundamental principles and rules adopted for the protection and processing of personal data in accordance with the KVKK, which are implemented within our company.

I. OUR GOAL:

Our goal is to take the necessary measures to raise awareness about the protection of personal data within our company, to establish procedures, and to ensure that internal operations comply with the KVKK. Our adopted KVK Policy aims to guide our company, company officials, personnel, persons we cooperate with, and visitors in terms of the implementation of the procedures and principles determined by the KVKK.

II. DETERMINATION OF RESPONSIBILITIES:

In order to ensure compliance with the KVKK and the KVK Policy, fulfill our obligations in this regard, take the necessary measures, and implement instructions, procedures, and training activities, KVK officers have been appointed from different departments within our company. The KVK officers will serve as a source of advice and guidance in the implementation of the KVKK and our KVK Policy. Compliance with the KVKK and our KVK Policy in all departments of our company is monitored and audited by the KVK officers.

III. MAIN PRINCIPLES OF OUR KVK POLICY:

1. GENERAL PRINCIPLES:

The following general principles are adopted in accordance with the KVKK regarding the processing of personal data:

a. CONDUCTING PERSONAL DATA PROCESSING ACTIVITIES IN ACCORDANCE WITH THE LAW AND THE RULE OF GOOD FAITH:

Our company acts in accordance with the laws, secondary legislation, KVK Institution decisions, and other legal regulations regarding the processing of personal data.

In accordance with the principle of fairness, personal data is processed only to the extent necessary for the purpose of processing, taking into account the reasonable expectations of data subjects. Data subjects are informed in advance about all operations performed with their data and, where necessary, their explicit consent is obtained.

b. ENSURING THAT PERSONAL DATA IS ACCURATE AND, WHERE NECESSARY, UP-TO-DATE:

Keeping personal data accurate and up-to-date is necessary to protect the fundamental rights and freedoms of data subjects.

To ensure that personal data is kept accurate and up-to-date, the accuracy of the sources from which personal data is collected is verified, and reasonable measures are taken in this regard. Data subjects are granted the right to request the correction or deletion of inaccurate or outdated data within this scope.

c. PROCESSING OF PERSONAL DATA FOR SPECIFIC, CLEAR, AND LEGITIMATE PURPOSES:

Personal data is processed for specific, explicit, and lawful purposes. In this context, our company determines the purpose for which personal data will be processed using the “personal data processing inventory” required by legislation, informs data subjects of these purposes before processing their personal data, and obtains their explicit consent in advance when necessary. Personal data is processed only within the scope of this information and consent.

d. PERSONAL DATA MUST BE RELEVANT, LIMITED, AND PROPORTIONATE TO THE PURPOSE FOR WHICH IT IS PROCESSED:

“Purpose limitation” is one of the most important principles governing the protection of personal data. Personal data must be relevant, limited, and proportionate to the purpose for which it is processed. Accordingly, our company avoids processing personal data that is not relevant or necessary for the processing purpose. Personal data is not processed for purposes that do not currently exist and are not expected to occur in the future. Minimizing data processing activities is fundamental to our company.

e. RETENTION OF PERSONAL DATA FOR THE PERIOD REQUIRED BY RELEVANT LEGISLATION OR NECESSARY FOR THE PURPOSE FOR WHICH THEY ARE PROCESSED:

Regarding the retention of personal data, if the legislation stipulates a period for the storage of data, this period is complied with, and personal data is only retained for as long as necessary for the purpose for which it is processed.

2. CONDITIONS FOR THE PROCESSING OF PERSONAL DATA:

While carrying out personal data processing activities, our company acts in accordance with the data processing conditions specified in Articles 5 and 6 of the KVKK, provided that the basic principles are complied with. In this regard, it is determined whether the data subject's explicit consent or one of the other data processing conditions for which explicit consent is not required is present for the personal data processing activities carried out. If the personal data processing conditions set out in Articles 5 and 6 of the KVKK are not met, personal data processing activities are not carried out.

3. TRANSFER OF PERSONAL DATA TO THIRD PARTIES:

While personal data processing activities are carried out in accordance with the KVKK, personal data is transferred to third parties within and outside the country only if sufficient protection measures are taken and if the data subject's explicit consent or one of the other cases where explicit consent is not required, as stipulated in Articles 8 and 9 of the KVKK, is present.

All necessary measures are taken to prevent personal data from falling into the hands of unauthorized third parties.

4. INFORMING DATA SUBJECTS:

Being informed about the processing of their personal data is the most natural right of data subjects.

As the data controller, our company informs the owners of the personal data it processes (e.g., employees, job applicants, visitors, customers) in accordance with Article 10 of the KVKK and the “Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform,” taking into account the specifics of each situation.

  • The purpose for which personal data is processed,
  • To whom and for what purpose the processed personal data is transferred,
  • The method and legal basis for collecting personal data, and
  • Informs the data subject about their rights as stipulated in Article 11 of the KVKK.

5. ENSURING DATA SECURITY:

In accordance with Article 12 of the KVKK, with the awareness of the importance of ensuring the security of personal data and protecting the fundamental rights and freedoms of data subjects;

  • To prevent the unlawful processing of personal data,
  • To prevent unlawful access to personal data, and
  • To ensure the preservation of personal data, all necessary technical and administrative measures are taken to provide an appropriate level of security.

6. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA:

Pursuant to Article 7 of the KVKK and the “Regulation on the Deletion, Destruction, or Anonymization of Personal Data,” even if processed in accordance with the KVKK and other relevant legislation, personal data must be deleted, destroyed, and anonymized (disposed of) ex officio or upon the request of the relevant data subject when the reasons for processing no longer exist. Necessary procedures and a separate policy have been prepared in our company to fulfill these obligations. In this regard, personal data that is no longer required and for which the reasons for processing no longer exist is immediately destroyed. In addition, at periodic intervals, personal data that must be destroyed, its users, and the users' access methods are identified, and the necessary destruction procedures are carried out in accordance with the KVKK and relevant legislation, thereby eliminating access to personal data.

7. APPLICATION TO OUR COMPANY:

As the data controller, in accordance with Article 13 of the KVKK and the “Communication on the Procedures and Principles for Applying to the Data Controller,” requests from data subjects regarding their personal data are resolved by our company as soon as possible and within a maximum of thirty (30) days, depending on the nature of the request. As a personal data subject, you may submit your requests regarding your rights in writing to the email address info@kemeralticanta.com.tr.

As a personal data owner,

  • You have the right to learn whether your personal data is being processed,
  • If your personal data has been processed, you have the right to request information about it,
  • You have the right to learn the purpose of processing your personal data and whether it is being used for its intended purpose,
  • Know the third parties to whom your personal data has been transferred within or outside the country,
  • Request the correction of your personal data if it has been processed incompletely or incorrectly, and request that the third parties to whom your personal data has been transferred be notified of this action,
  • Requesting the deletion or destruction of personal data when the reasons for processing no longer exist, even if the data has been processed in accordance with the provisions of the KVKK and other relevant laws, and requesting that the third parties to whom the personal data has been transferred be notified of this action,
  • Object to the analysis of processed data exclusively through automated systems resulting in a decision against the individual,
  • You have the right to request compensation for damages incurred due to the unlawful processing of personal data.