General Information about the Personal Data Protection Law The Law on Protection of Personal Data No. 6698 (hereinafter referred to as PDPL) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Some provisions of the PDPL entered into force on the date of publication, while others entered into force on October 7, 2016. Notification in the capacity of Data Controller In accordance with the PDPL No. 6698 and in the capacity of Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties where permitted by legislation, classified, and processed in the manner described in this page and as specified by the PDPL. How your personal data may be processed In accordance with the PDPL No. 6698, your personal data shared with our Organization may be obtained, recorded, stored, modified, reorganized, and in short, subject to all kinds of processing carried out on data, either fully or partially, automatically, or by non-automatic means provided that they are part of any data recording system. Under the PDPL, all operations performed on data are considered “processing of personal data.” Purposes and legal grounds for processing your personal data The personal data you share will be processed in accordance with Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette No. 29457 dated 26.08.2015, the Distance Contracts Regulation published in the Official Gazette No. 29188 dated 27.11.2014, and other relevant legislation; for the purposes of fulfilling the requirements of services provided to our members, in accordance with contractual and technological requirements, improving our products and services offered; recording identity, address and other necessary information to identify the transaction owner; for banking and electronic payment obligations including payment systems, electronic contracts or all records and documents to be used as a basis for paper-based transactions; to comply with information storage, reporting, and notification obligations required by legislation and other authorities; to provide information to prosecutors, courts, and relevant public officials upon request and as required by legislation regarding public security matters and legal disputes. Information about third parties or organizations to whom your personal data may be transferred The persons/organizations to whom your personal data shared with our Organization may be transferred include primarily IdeaSoft Software Inc., which provides our e-commerce infrastructure, as well as suppliers, cargo companies and related persons and organizations related to the services offered, program partner organizations from which we receive services and/or cooperate as Data Processor, domestic/foreign organizations and other third parties. How your personal data is collected Your personal data is collected through forms on our Organization’s website and mobile applications including information such as name, surname, ID number, address, phone, business or personal email address; data containing preferences on pages accessed using username and password, IP records of transactions performed, cookie data collected by the browser including browsing duration and details, location data; through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing and call center channels verbally, in writing, or electronically; for purposes such as establishing commercial relationships with our Organization, making job applications, submitting proposals, through business cards, resumes (CV), proposals and other means. Personal data obtained before the PDPL entered into force Your personal data obtained lawfully before April 7, 2016, the effective date of the PDPL, through membership, electronic message consent, product/service purchases and other means, is also being processed and preserved in accordance with the terms and conditions set forth in this document. Transfer of your personal data abroad Your personal data collected by any of the above-mentioned methods, whether processed in Turkey or processed and stored outside Turkey, may also be transferred to service intermediaries located abroad (in countries accredited by the Personal Data Board and where adequate protection is provided regarding the protection of personal data) within the scope of the PDPL and in accordance with contractual purposes. Storage and protection of personal data Your personal data will be kept confidential in the database and systems at our Organization in accordance with Article 12 of the PDPL; and will not be shared with third parties in any way except for legal obligations and the arrangements specified in this document. Keeping personal data current and accurate In accordance with Article 4 of the PDPL, our Organization has an obligation to keep your personal data accurate and current. In this context, our Members need to share their accurate and current data or update them through the website/mobile application so that our Organization can fulfill its obligations arising from the current legislation. Rights of the personal data owner under PDPL No. 6698 Article 11 of the PDPL No. 6698 entered into force on October 7, 2016, and pursuant to this article, the Personal Data Owner has the following rights: To learn whether personal data is being processed; To request information if personal data has been processed; To learn the purpose of processing personal data and whether they are used in accordance with their purpose; To know the third parties to whom personal data is transferred domestically or abroad; To request correction if personal data is processed incompletely or inaccurately; To request deletion or destruction of personal data within the framework of conditions stipulated in Article 7 of the PDPL; To request that correction, deletion, and destruction operations be notified to third parties to whom personal data has been transferred; To object to a result arising against the person through analysis of processed data exclusively through automated systems; To claim compensation for damages in case of damage due to unlawful processing of personal data.
