[Company Name / Brand] Personal Data Policy

General Information About the Personal Data Protection Law

The Personal Data Protection Law No. 6698 (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 on April 7, 2016. Some parts of KVKK came into force on the date of publication, while others became effective on October 7, 2016.

Information as a Data Controller

In accordance with the KVKK No. 6698 and in the capacity of a Data Controller, your personal data will be recorded, stored, updated, disclosed/transferred to third parties where permitted by legislation, classified, and processed as outlined on this page.

How Your Personal Data May Be Processed

According to KVKK No. 6698, the personal data you share with our company may be obtained, recorded, stored, modified, reorganized, and processed either automatically or manually as part of a data recording system. In KVKK, any action performed on data is considered "processing of personal data."

Purposes and Legal Grounds for Processing Your Personal Data

Your personal data is processed for the following purposes:

• To fulfill our services in accordance with contracts and technological requirements, and to improve our products and services.
• To identify the transaction owner’s information, including identity, address, and other necessary details, under the Law on the Regulation of Electronic Commerce No. 6563, the Consumer Protection Law No. 6502, and related regulations.
• To issue all records and documents necessary for banking and electronic payment systems, electronic contracts, and paper transactions, in compliance with legislation.
• To comply with information storage, reporting, and disclosure obligations imposed by relevant authorities.
• To provide information to prosecutors, courts, and relevant public officials when required for public security or legal disputes.

Your personal data will be processed in accordance with KVKK and secondary regulations.

Transfer of Your Personal Data to Third Parties

For the purposes listed above, your personal data may be shared with:

• Our company's e-commerce infrastructure provider, IdeaSoft Yazılım San. ve Tic. A.Ş.,
• Suppliers, courier companies, and service providers related to our operations,
• Program partners and third parties from whom we receive services as Data Processors,
• Domestic and international institutions and business partners.

Collection of Your Personal Data

Your personal data may be collected through various channels, including:

• Online forms on our website and mobile applications, including identity, address, contact details, preferences, browsing history, IP logs, cookies, and location data,
• Verbal, written, or electronic communications via our sales and marketing teams, branches, suppliers, and other sales channels,
• Business cards, CVs, or offers provided in the context of business relationships, job applications, or commercial transactions,
• Public databases, surveys, contests, campaigns, social media, and other open sources.

Personal Data Collected Before KVKK Came Into Effect

Personal data lawfully obtained before KVKK’s effective date (April 7, 2016) through membership, electronic communication permissions, product/service purchases, and other means are processed and stored in accordance with the terms of this document.

Transfer of Personal Data Abroad

Your personal data, processed in Turkey or transferred abroad for storage and processing, may be sent to accredited service providers in countries approved by the Personal Data Protection Authority, in compliance with KVKK.

Storage and Protection of Personal Data

Your personal data is securely stored in our company's databases and systems, in accordance with Article 12 of KVKK. Unless required by law or stated otherwise in this policy, your data will not be shared with third parties. Our company takes technical and physical security measures to prevent unauthorized access and illegal processing of personal data. In the event of a data breach, the situation will be reported to the Personal Data Protection Authority in accordance with legal regulations.

Keeping Personal Data Accurate and Up-to-Date

Under Article 4 of KVKK, our company is required to keep personal data accurate and up to date. To fulfill legal obligations, customers must provide accurate and up-to-date information through our website or mobile application.

Rights of Personal Data Owners Under KVKK

As of October 7, 2016, personal data owners have the following rights under Article 11 of KVKK:

• To inquire whether their personal data has been processed,
• To request information if their personal data has been processed,
• To learn the purpose of data processing and whether it is used appropriately,
• To know the third parties to whom personal data is transferred, domestically or internationally,
• To request correction of incomplete or incorrect personal data,
• To request deletion or destruction of personal data under Article 7 of KVKK,
• To request notification of corrections, deletions, or destructions to third parties who have received the data,
• To object to negative consequences resulting from automated data processing,
• To claim compensation for damages caused by unlawful processing of personal data.

[Company Name], registered with [Chamber of Commerce] under registration number [......] and holding MERSIS number [......], located at [......], acts as the Data Controller under KVKK. The Data Controller Representative appointed by our company will be announced on our website and in the Data Controllers Registry once the legal framework is in place.

Personal Data Owners can direct their questions, opinions, or requests via the following communication channels:

Email: [......]
Phone: [......]
Fax: [......]