[Company Name / Brand] Personal Data Policy

General Information about the Personal Data Protection Law

The Law on the Protection of Personal Data No. 6698 (hereinafter referred to as KVKK) was accepted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Some provisions of KVKK came into force on the publication date, while others became effective on October 7, 2016.

Information as Data Controller

In accordance with the KVKK No. 6698 and in the capacity of Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties when permitted by the legislation, classified, and processed in the ways specified in KVKK.

How Your Personal Data May Be Processed

Under KVKK No. 6698, the personal data you share with our company may be collected, recorded, stored, altered, restructured, or otherwise processed in any manner on our part, either wholly or partially, through automatic means or through non-automatic means as part of a data recording system. All activities performed on data under KVKK are considered as "processing of personal data."

Purposes and Legal Grounds for Processing Your Personal Data

The personal data you share will be processed:

• To fulfill the requirements of the services we provide to our customers, in accordance with the contract and technological needs, and to develop our products and services;
• To record identity, address, and other necessary information for identifying the data subject, in accordance with the Law on Regulating Electronic Commerce No. 6563, the Law on the Protection of Consumers No. 6502, and related regulations such as the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, published in Official Gazette No. 29457 on August 26, 2015, and the Regulation on Distance Contracts published in Official Gazette No. 29188 on November 27, 2014, as well as other relevant legislation;
• To organize payment systems, electronic contracts, or paper-based records and documents required by law, and to comply with information retention, reporting, and notification obligations stipulated by legislation and other authorities in the banking and electronic payment fields;
• To provide information to prosecutors, courts, and relevant public officials, if required by law, regarding public safety and legal disputes;

Your personal data will be processed in accordance with KVKK and related secondary regulations.

Information on Third Parties or Organizations to Whom Your Personal Data May Be Transferred

For the above-mentioned purposes, your personal data shared with our company may be transferred to individuals/organizations such as IdeaSoft Yazılım San. ve Tic. A.Ş., which provides our e-commerce infrastructure, suppliers, cargo companies, and other parties related to the services provided, as well as program partner organizations with whom we collaborate, both domestic and international, and other third parties.

Collection of Your Personal Data

Your personal data may be collected:

• Through forms on our company’s website and mobile applications, including information such as name, surname, TC identity number, address, phone, business or personal email address; data collected from IP logs of transactions performed on pages accessed with usernames and passwords, browser cookies, navigation duration, and details; and location data;
• Through sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call center channels, either verbally, in writing, or electronically;
• From individuals who share their personal data for purposes such as establishing a commercial relationship with our company, applying for a job, or making an offer, through business cards, resumes (CVs), and other means, either in physical or virtual environments, face-to-face or remotely, verbally, in writing, or electronically;
• Additionally, through indirect channels, including data collected from websites, blogs, contests, surveys, games, campaigns, and similar micro-websites and social media, newsletter reading or clicking activities, publicly available databases, and social media profiles.

Personal Data Obtained Before the Enforcement of KVKK

Personal data obtained legally before the enforcement date of KVKK on April 7, 2016, through membership, electronic communication consent, product/service purchases, and other means, are also processed and stored in accordance with the conditions and provisions set out in this document.

Transfer of Personal Data Abroad

Personal data collected through the methods mentioned above may be transferred abroad (to countries accredited by the Personal Data Protection Board and where adequate protection is provided) for processing or storage, in compliance with KVKK and for contractual purposes.

Storage and Protection of Personal Data

Your personal data will be kept confidential in our company's databases and systems in accordance with Article 12 of KVKK; and will not be shared with third parties except as required by legal obligations and regulations stated in this document. Our company is obligated to take necessary measures, including software and physical security measures, to prevent unlawful processing of personal data and unauthorized access to systems and databases. If it is discovered that personal data has been unlawfully obtained by others, the situation will be promptly reported to the Personal Data Protection Board in accordance with legal regulations.

Accuracy and Update of Personal Data

According to Article 4 of KVKK, our company has the obligation to keep personal data accurate and up-to-date. To fulfill the obligations arising from current legislation, our customers must share or update accurate and current data through the website or mobile application.

Rights of the Personal Data Subject Under KVKK No. 6698

As per Article 11 of KVKK, which came into force on October 7, 2016, the rights of the personal data subject are as follows:

• Learn whether personal data is processed,
• Request information about the processing of personal data if it has been processed,
• Learn the purpose of processing personal data and whether it is used in accordance with its purpose,
• Know the third parties to whom personal data has been transferred, domestically or abroad,
• Request correction of personal data if it is incomplete or incorrect,
• Request deletion or destruction of personal data under the conditions specified in Article 7 of KVKK,
• Request notification of these operations to third parties to whom the personal data has been transferred,
• Object to a result arising against the person due to the exclusive automated processing of data,
• Request compensation for damages caused by the unlawful processing of personal data.

Contact Information

[Company Name], registered with the [................] Chamber of Commerce under registry number [...................] and with MERSIS number [...................], located at [.......................................................................], is the Data Controller under KVKK. The Data Controller Representative appointed by our company will be announced on the Data Controllers Registry and the website where this document is located once the legal infrastructure is established. Personal data subjects may direct their questions, comments, or requests to the following contact channels:

Email: [.........................]

Phone: [.........................]

Fax: [.............................]