Turkish Personal Data Protection Law

Personal Data Protection and Processing Policy

 

  1. DATA PRIVACY COMMITMENT

 

This Data Privacy and Security Policy (“Policy”), Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. While fulfilling the data protection obligations implemented by the Personal Data Protection Law No. 6698 and other relevant legislation and additionally processing personal data, within Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. and/or Akyol Mobilya Orman Ürünleri San.ve Tic. LLC. It determines the principles to be followed by.

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It undertakes to apply a sufficient and reasonable level of security for the personal data it holds, to respect the confidentiality of personal data and to comply with this Policy and the tools, programs and processes to be implemented in accordance with the Policy.

  1. PURPOSE OF THE POLIC

The main purpose of this Policy is to set forth the principles regarding the protection of personal data and personal data processing activities carried out in accordance with the law by Akyol Mobilya Orman Ürünleri San. .

  1. SCOPE OF THE POLIC

This Policy; It covers all departments and employees of Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti..

This Policy; Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti.. will cover all activities in which it processes personal data and will be applied in all kinds of events and actions.

This Policy will not apply to data that has been anonymized or is not personal data.

In case it is determined by new legislation, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It will provide a higher level of security on personal data in compliance with new legislation and comply with regulatory requirements.

This Policy applies to Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. In cases where it is determined that there is a legal obstacle in its implementation, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It will re-determine the steps it will take, in consultation with the Board, if deemed necessary.

  1. DEFINITIONS

The definitions used in this Policy are listed below:

Explicit consent Consent regarding a specific issue, based on information and expressed with free will
Anonymization Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data
Personal data Any information regarding an identified or identifiable natural person
Processing of personal data Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system. Any action taken on the data, such as preventing its use or
KVK Law Personal Data Protection Law No. 6698
KVK Board Personal Data Protection Board
KVK Authority Personal Data Protection Authority
Personal data of special nature Data regarding people's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data
Data processor Natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.
Personal data owner Personal data owner is the natural person whose personal data is processed, who is considered as the "relevant person" in the KVK Law.
Data controller The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Controllers Registry (VERBİS) kept by the Presidency under the supervision of the Personal Data Protection Board.
Data Inventory Personal data processing activities carried out by Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. depending on its business processes; The inventory created and detailed by associating it with the personal data processing purposes, the recipient group to which the personal data is transferred, and the relevant personal data owner group.

 

  1. PERSONAL DATA INVENTORY AND CLASSIFICATION OF PERSONAL DATA

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. before; In line with the legitimate and lawful personal data processing purposes of Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti., the processing of personal data is based on and limited to one or more of the personal data processing conditions specified in Article 5 of the KVK Law. By complying with the general principles specified in the KVK Law and all obligations regulated in the KVK Law, including the principles specified in Article 4 regarding the Personal Data Protection Law, and personal data owners within the scope of this Policy (Customers, Potential Customers, Employees, Employee Candidates, Supplier Employees with whom we cooperate, Supplier Limited to Authorities, Reference, Shareholder/Partner, Employee Relative, Reference) ;

  • Fulfilling the requirements of the commercial activities carried out by our company and ensuring that the relevant persons benefit from the products and services offered by our company through the performance of the service,

  • Carrying out the necessary work by the relevant business units of our company and carrying out related business processes and making reports,
  • Determining and implementing our company's commercial, operational and business strategies,
  • Ensuring the legal and commercial security of third parties who have a business relationship with our company and the products and services offered by our company and/or suppliers, monitoring legal processes and establishing, exercising and protecting rights arising from the legislation,
  • Ensuring that our company activities are carried out in accordance with company procedures or relevant legislation,
  • Planning, auditing and execution of corporate sustainability, corporate governance, strategic planning and information security processes; ensuring business continuity,
  • Execution of work and management of relationships with our business partners in sectors that vary depending on needs,
  • Fulfilling information sharing, reporting and information obligations stipulated by public institutions and all authorities,
  • Fulfilling information and document retention obligations arising from legal legislation,
  • Carrying out the planning and statistical activities required by our company,
  • Determining and implementing our company's commercial and business strategies,
  • Conducting our finance, communication, market research and purchasing operations,
  • Maintaining in-company system and application management operations,
  • For the purposes of managing our legal processes and providing you with a better and more reliable service without interruption, personal data will be processed within the scope of the processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It has created a personal data inventory in accordance with the Data Controllers Registry Regulation issued by the Personal Data Protection Authority. This data inventory includes data categories, data source, data processing purposes, data processing process, recipient groups to which the data is transferred and storage periods.

In this context, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It includes, but is not limited to, the following types of data categories:

Identity information, contact information, personnel information, legal transaction information, customer transaction information, physical location security information, transaction security information, financial information, marketing sales information, visual and audio recording information, race and ethnic origin information, religious information (in the old ID ), health information, criminal convictions and security measures information and other information (signature) data category.

  1. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

Compliance with Law

Our company carries out its personal data processing activities in accordance with the law and the rules of honesty, in accordance with the Constitution, the Personal Data Protection Law and the relevant legislation.

Keeping the Data Accurate and Up-to-Date When Necessar

Our company; It ensures that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights of personal data owners and its own legitimate interests, and takes the necessary measures in this regard. In this context, data regarding all categories of persons are tried to be kept up-to-date, and all kinds of administrative and technical measures are taken to ensure accuracy and up-to-dateness. (Each unit and data processing personnel are responsible for ensuring that the data they process is up-to-date.)

Specific, Legitimate and Clear Purpose

Our company; It processes personal data only for clearly and precisely determined legitimate purposes and does not engage in data processing activities other than these purposes. The purpose for which personal data will be processed by our company is determined before the processing activity and is processed in the "Personal Data Inventory".

Data must be related to the purpose for which they are processed, limited and proportionate.

Personal data is processed by our company to the extent necessary to achieve the specified purposes. Data processing is not carried out with the assumption that it can be used later. . In this context, processes are constantly reviewed and the principle of reducing personal data is tried to be implemented.

Keeping Personal Data as Long as Necessary and Deleting It Afterwards

Our company retains personal data only for the period specified in the relevant legislation or necessary for the purpose for which they are processed. In this context, our Company first determines whether a period of time is foreseen for the storage of personal data in the relevant legislation, and if a period is determined, it acts in accordance with this period, in this context, it takes into account the civil and criminal statute of limitations and stores personal data for the period necessary for the purpose for which they are processed. If the period expires or the reasons requiring processing disappear, personal data is deleted, destroyed or anonymized in accordance with our Company's "Data Destruction Policy".

  1. TERMS OF PROCESSING OF PERSONAL DATA

Personal data can only be collected, processed or used within the scope of the legal bases specified below.

Explicit Consent

Protection of personal data is a Constitutional right, and fundamental rights and freedoms can only be limited by law, without affecting their essence, based on the reasons specified in the relevant articles of the Constitution. In accordance with the third paragraph of Article 20 of the Constitution, personal data can only be processed in cases stipulated by law or with the explicit consent of the person. Our company processes personal data without seeking the express consent of the relevant person only if the following conditions are met;

  • Explicit consent must be given with free will, otherwise it is void.
  • Explicit consent will be obtained from the relevant person in writing or electronically. In addition to these situations, verbal consent may also be accepted in cases where recording is required. In this way, explicit consent will be recorded in a verifiable manner. Individuals will be informed of their relevant rights before obtaining explicit consent.
  • In cases where it is necessary to process special personal data, explicit consent will be obtained in a verifiable manner.
  • Departments that process personal data are obliged to check the existence and validity of the relevant data owner's explicit consent when collecting the personal data they process. If it is determined that there is no explicit consent, data processing activity will be stopped.

Processing of Personal Data Without Explicit Consent

  • It is clearly stipulated in the law,
  • It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
  • It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
  • It is mandatory for the data controller to fulfill its legal obligation,
  • The data has been made public by the owner himself,
  • Data processing is mandatory for the establishment, exercise or protection of a right,
  • Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner.

Processing of Special Personal Data

  • Special categories of personal data can only be processed if there is a demonstrable explicit consent of the data owner or if it is clearly provided for by law.
  • Personal data regarding health and sexual life can only be processed without explicit consent for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing. In the case of such processing, the data processor is under a duty of confidentiality.
  • While processing special personal data, adequate measures determined by the Board will be taken.
  • KVKK Committee in all cases where special personal data must be processed

Processing of Employees' Data

  • All personal data processing principles determined above will also be applied to employees' personal data.
  • Personal data of job applicants without using CV collection channels may be processed without their explicit consent in order to initiate a business relationship. If an application received in this way is evaluated negatively for a suitable position, the personal data of the relevant person will be deleted. It will only be stored with the express consent of the employee candidate.
  • Employee personal data in connection with the employment relationship and the performance of the contract may be processed without the express consent of the employees. Otherwise, there must be a justification such as employee consent, legal conviction, legitimate interest or similar.

 

  1. TRANSFER OF PERSONAL DATA

Transfer to Third Parties in Turkey

  • Personal data can only be transferred to third parties in Turkey in cases where the relevant person has explicit consent.
  • Personal data may be transferred to third parties in Turkey without the person's explicit consent, if at least one of the conditions specified in the 2nd paragraph of Article 5 of the law is valid.
  • The relevant department making the transfer is responsible for ensuring compliance with the obligations to be followed during the transfer of personal data within Turkey.

Transfer to Third Parties Abroad

  • Regarding the transfer of personal data abroad, the explicit consent of the data owner is required in accordance with Article 9 of the KVKK.
  • However, if there are conditions that allow the processing of personal data, including personal data of special nature, without the explicit consent of the data owner, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. . Personal data may be transferred abroad by.
  • If the country to be transferred is not determined by the Board among the countries with adequate protection, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. and the data controller/data processor in the relevant country will undertake adequate protection in writing and permission will be obtained from the Board.

Transfer of Personal Health Data

  • Personal health data cannot be transferred to third parties without being anonymized, in compliance with the legislation, and without obtaining the necessary permissions and approvals.
  • Personal health data can be transferred to public institutions and organizations within the framework of the purposes of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing, and if it is clearly foreseen by law.
  • The relevant department making the transfer is responsible for ensuring compliance with the obligations to be followed during the transfer of health data.
  1. RIGHTS OF RELATED PERSONS

  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. It will respond to the following requests of the relevant persons whose personal data it holds, within the periods specified in the law:
  • Information about whether personal data is processed or not,
  • Information about which personal data it processes,
  • Information about whether personal data has been transferred or not,
  • Information about third parties to whom personal data is transferred and the contact persons of third parties,
  • Purpose of processing personal data,
  • Responding when the person requests that the relevant personal data be updated,
  • Request for anonymization, deletion or destruction of personal data,
  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Receive a copy of your personal data held in
  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. They can contact the KVKK Officer using their contact information. (You can also apply within the scope of the above-mentioned rights using the KVKK application form on the website.)
  1. PRİVACY

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. All personal data processed within the scope of the law are confidential. Employees may carry out collection, processing, transfer, use, deletion, destruction and anonymization activities on personal data only within the authority defined for them. Otherwise, employees are prohibited from carrying out these activities. Additionally, employees may not use personal data for individual or commercial purposes.

  1. SECURITY

The security of personal data is determined by the employee, department and Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti respectively. is your responsibility. Personal data must be protected against loss, unlawful processing, misuse, and all kinds of processing by unauthorized persons. These security measures cover all personal data stored electronically and physically.

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. In order to ensure the lawful processing of personal data, it takes technical and administrative measures according to technological possibilities and implementation costs.

Technical Measures Taken to Ensure Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. In order to protect your personal data, it has taken all kinds of technical and technological security measures and protects your personal data against possible risks. For example;

  • Network security and application security are ensured.
  • A closed system network is used for personal data transfer via the network.
  • Security measures are taken within the scope of supply, development and maintenance of information technology systems.
  • Access logs are kept regularly.
  • The authorities of employees who change their duties or leave their jobs in this area are removed.
  • Up-to-date anti-virus systems are used.
  • Firewalls are used.
  • Personal data is backed up.
  • Intrusion detection and prevention systems are used.
  • If special personal data is to be sent via e-mail, it must be sent encrypted and using a KEP or corporate mail account.
  • Log records are kept without user intervention.
  • Cyber security measures have been taken and their implementation is constantly monitored.

Administrative Measures Taken to Ensure Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data

  • A management framework has been established to initiate and control information security operation and implementation within the organization.
  1. KVKK Committee and Contact Person have been appointed and job descriptions have been determined.
  2. KVKK Application channels have been determined.
  3. Violation, request/complaint management workflows have been determined.
  • Main principles, policies and procedures regarding the processing and protection of personal data have been determined.
  1. Data Processing and Storage Policy has been Created.
  2. Personal Data Processing and Protection Policy has been Created.
  3. Information Security Management Policy has been created.
  4. A Policy has been Created for the Security of Special Personal Data.
  • Existing risks and threats have been determined within the scope of processed personal data.
  • Training and awareness activities are carried out for employees regarding personal data security.
  • Roles, responsibilities and job descriptions regarding data security have been determined to ensure that employees and contractors are aware of and fulfill their information security responsibilities.
  • There is a disciplinary process for employees who fail to comply with security policies, guidelines and procedures.
  • Confidentiality commitments are made.
  • Employee, customer, supplier etc. Clarification text has been published for.
  • Processes requiring explicit consent have been determined and implemented.
  • It is evaluated whether the personal data mentioned is needed for the purpose of processing, and personal data is reduced as much as possible.
  • If the data is obtained by others through illegal means, necessary precautions are taken by the employees to notify the relevant person and the Board within 72 hours.

Precautions to be Taken in Case of Illegal Disclosure of Personal Data

If the processed personal data is obtained by others through illegal means, our Company will notify the relevant data owner and the Board as soon as possible (within a maximum of 72 hours).

  1. PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT AT BUILDING ENTRANCES AND WITHIN THE BUILDING

  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. In order to ensure security by Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal data processing activities are carried out for monitoring guest entries and exits through security cameras in the buildings.
  • By using security cameras, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal data processing activities are carried out by. Camera recordings are kept for 3 weeks.
  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Within the scope of surveillance activity with security cameras; It aims to protect the interests of the company and other persons regarding security.
  • This monitoring activity is carried out in accordance with KVKK and the Law on Private Security Services and relevant legislation.
  • In this context, the information that camera monitoring is taking place is announced to all employees and visitors and people are informed. Notification letters are hung at the entrances of the monitored areas.
  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. In accordance with Article 12 of the KVK Law, the necessary technical and administrative measures are taken to ensure the security of personal data obtained as a result of camera monitoring activities.
  1. MONITORING OF GUEST ENTRANCES AND EXITS IN THE MANAGEMENT BUILDING, FACILITY ENTRANCES AND INSIDE

  • Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. by; For the purpose of ensuring security and other purposes specified in this Policy, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal data processing activities are carried out to track guest entries and exits in its buildings.
  • Konukyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal data owners in question are informed in this context through texts posted on the site or made accessible to guests in other ways.
  • The data obtained for the purpose of tracking guest entry and exit is processed only for this purpose and the relevant personal data is recorded in the data recording system in the physical environment.
  • In places where privacy is high, imaging is not performed.
  1. AKYOL MOBİLYA ORMAN ÜRÜNLERİ SAN.VE TİC.LTD.ŞTİ. STORING RECORDS OF THE INTERNET ACCESS PROVIDED TO OUR VISITORS IN THE FACILITIES

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. for the purpose of ensuring security and other purposes specified in this Policy; Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Internet access can be provided to our Visitors upon request during their stay in our buildings and facilities. In this case, log records regarding your internet access are kept in accordance with the mandatory provisions of Law No. 5651 and the legislation issued in accordance with this Law; These records can only be sent to Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti if requested by authorized public institutions and organizations. It is processed in order to fulfill our relevant legal obligation during the audit processes to be carried out.

  1. DESTRUCTION (DELETION, DESTRUCTION AND ANONYMIZATION) CONDITIONS OF PERSONAL DATA

In accordance with Article 138 of the Turkish Penal Code, Article 7 of the KVK Law and the "Regulation on Deletion, Destruction and Anonymization of Personal Data" issued by the Institution; Even though it has been processed in accordance with the provisions of the relevant law, in case the reasons requiring processing disappear, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal data is deleted, destroyed or made anonymous based on its own decision or upon the request of the personal data owner. Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. A Policy has been created in accordance with the provisions of the regulation on this subject, and in accordance with this Policy, the data is destroyed according to its nature. In accordance with this regulation, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Periodic destruction dates have been determined by the company, and a calendar has been created according to which periodic destruction will be carried out at various intervals with the beginning of the obligation (every 6 months).

  1. VIOLATION INCIDENTS

Each employee working at Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. has the right to report any action or event that he/she thinks is contrary to the restrictions specified within the scope of the Personal Data Protection Law No. 6698 and this Policy, to the department managers in writing as soon as they become aware of the situation. is responsible for. If the transfer is not made, the damage and penal liability that may arise may be recourse to the employee.

As a result of the information provided, Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. 's KVKK committee is obliged to notify the relevant person or authorized institution (KVKK) regarding violation actions or events, taking into account the legislation.

  1. RESPONSIBILITIES

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Responsibilities are listed as employee and department respectively. In this context;

  • Employees are responsible for all personal data in printed or computerized formats within their work areas and will comply with the conditions specified in the law and this Policy in any processing of this data.
  • Department managers are responsible for all personal data, whether printed or computerized, processed by employees within their departments, and ensure that their department complies with the conditions specified in the law and this Policy for all processing of this data.
  • Department managers will contribute to the implementation of this Policy in their own departments by carrying out checks and audits.
  • Employees in managerial positions are responsible for personal data processing activities within their field and will ensure that personal data is processed in accordance with the law and this Policy.
  • Departments may use Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. in any case of new data processing, data deletion, uncertainty and similar situations regarding personal data. is obliged to inform the KVKK Committee of . Damage and penal liability that may arise in case of failure to inform may be recourse to the employee.
  1. EXECUTIVE

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. is responsible for the implementation of this Policy. A management structure has been established to ensure compliance with the KVK Law regulations and the implementation of the Personal Data Protection and Processing Standard.

Akyol Mobilya Orman Ürünleri San.ve Tic.Ltd.Şti. Personal Data Protection Committee ("Committee") has been established in accordance with the decision of the Company's senior management to manage this Policy and other Policies affiliated and related to this Policy.

  1. EFFECTIVE DATE OF THE POLICY

This Policy entered into force on…/…/.2020.

0

Sales Points
0
Total
Customer
0
Total
Sales
0
Total
City
Pry Up To
Kastamonu Entegre
Hettich
Button Furniture Led Lighting Systems
Alusmart Aluminyum
DataSolin
Şişecam (Yeni Yılmaz Cam)
Portakal Kenar Bantları
Jütesan
x