Protection of Personal Data
1. PURPOSE
Law No. 6698 on the Protection of Personal Data (“KVKK”) was published in the Official Gazette dated April 7, 2016 and numbered 29677. KVKK protects the fundamental rights and freedoms of natural persons whose personal data are processed, including the privacy of private life protected by the Constitution, and determines the obligations of natural and legal persons processing personal data.
The purpose of this Policy is to define the implementation rules and related obligations to ensure that personal data belonging to data subjects are processed and protected by Çalık Holding A.Ş. and Group Companies (“Çalık Group”) in compliance with KVKK.
The purpose of this Policy is to define the implementation rules and related obligations to ensure that personal data belonging to data subjects are processed and protected by Çalık Holding A.Ş. and Group Companies (“Çalık Group”) in compliance with KVKK.
2. SCOPE
Within the scope of this Policy; customers, potential customers, job applicants, employees, company shareholders, company officials, visitors, employees, shareholders and officials of collaborating companies, and third parties include natural persons whose data are processed by fully or partially automated means or non-automated means provided that they are part of any data recording system. The Policy applies to all activities carried out for the processing and protection of personal data owned or managed by Çalık Group.
This Policy has been prepared in accordance with KVKK and other relevant legislation.
Çalık Group will provide sufficient training and auxiliary reference materials to all employees within its structure to ensure that they properly protect company assets.
This Policy defines the key control measures that everyone in Çalık Group is expected to know and continuously comply with.
This Policy has been prepared in accordance with KVKK and other relevant legislation.
Çalık Group will provide sufficient training and auxiliary reference materials to all employees within its structure to ensure that they properly protect company assets.
This Policy defines the key control measures that everyone in Çalık Group is expected to know and continuously comply with.
3. DEFINITIONS AND ABBREVIATIONS
In this section, special terms and expressions, concepts, abbreviations, etc. mentioned in the Policy are briefly explained.
- Explicit Consent: Consent regarding a specific subject, based on information and declared with free will, limited to the purpose of data processing.
- Anonymization: Rendering personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data.
- Çalık Group: Çalık Holding A.Ş. and Group Companies.
- Çalık: Çalık Holding A.Ş.
- Employee: Çalık Group employee.
- Group Company: Expresses the legal entity personality of companies in which Çalık Holding A.Ş. and/or its shareholders directly or indirectly, separately or together, hold at least 50% of the capital, dividend, or voting rights. This definition also includes companies where Çalık Holding A.Ş. and/or its shareholders hold less than the above ratio, provided that a decision is taken by the Board of Directors of the relevant Companies and in addition to the legislative provisions of the country where they are established.
- Service Provider: Employee of the company (supplier, subcontractor, customer, etc.) from which Çalık Group receives and/or provides services.
- Personal Data Subject (Data Subject): Natural person whose personal data is processed.
- Personal Data: Any information relating to an identified or identifiable natural person.
- Processing of Personal Data: Any operation performed on data such as obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data by fully or partially automated means or non-automated means provided that it is part of any data recording system.
- Board: Personal Data Protection Board.
- Authority: Personal Data Protection Authority.
- KVKK: Law No. 6698 on the Protection of Personal Data published in the Official Gazette dated April 7, 2016 and numbered 29677.
- Special Categories of Personal Data: Personal data of special nature as defined under the Çalık Group Personal Data Protection and Processing Policy.
- Policy: Çalık Group Personal Data Protection and Processing Policy.
- Data Processor: The natural or legal person processing personal data on behalf of the data controller based on the authorization given by the data controller.
- Data Controller: The natural or legal person who determines the purposes and means of processing personal data, is responsible for the establishment and management of the data recording system, and is obliged to register with the Data Controllers Registry.
4. ROLES AND RESPONSIBILITIES
4.1 Data Controller
Pursuant to KVKK, any operation performed on personal data such as obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of data by fully or partially automated means or non-automated means provided that it is part of any data recording system constitutes processing of personal data.
Çalık Group declares that it is responsible for determining the purposes and means of processing personal data registered in its database, for establishing and managing the data recording system, and will hold the title of registered data controller by performing data controller registration when the Data Controllers Registry opens.
Çalık Group declares that it is responsible for determining the purposes and means of processing personal data registered in its database, for establishing and managing the data recording system, and will hold the title of registered data controller by performing data controller registration when the Data Controllers Registry opens.
4.2 Data Controller Representative
When the Data Controllers Registry is established, a data controller representative required for registration with said registry will be appointed for all Group Companies within Çalık Group, and this person will be an expert responsible for managing and executing the protection and processing of all personal data, taking security measures, and conducting regular audits.
4.3 Data Processor
Natural or legal persons processing personal data on behalf of Çalık Group based on the authorization given by it (e.g., contractors, suppliers) shall be accepted as data processors.
If personal data is processed by another natural or legal person on behalf of Çalık Group, Çalık Group as the data controller and the data processors shall be jointly responsible for taking measures. Çalık Group, as the data controller, periodically audits the compliance of data processors with this policy to ensure that the trust provided to them by data subjects sharing personal data is maintained in the same manner by business partners, service providers, suppliers, and contractors.
If personal data is processed by another natural or legal person on behalf of Çalık Group, Çalık Group as the data controller and the data processors shall be jointly responsible for taking measures. Çalık Group, as the data controller, periodically audits the compliance of data processors with this policy to ensure that the trust provided to them by data subjects sharing personal data is maintained in the same manner by business partners, service providers, suppliers, and contractors.
5. LEGAL OBLIGATIONS
Pursuant to KVKK, Çalık Group has legal obligations within the scope of personal data protection and processing. The obligations in question are listed as follows:
5.1 Obligation to Inform
Çalık Group is obliged to inform the data subject during the collection of personal data and to provide information to the data subject on the following matters within this scope:
- Identity of the data controller and, if any, its representative,
- The purpose for which personal data will be processed,
- To whom and for what purpose the processed personal data may be transferred,
- The method and legal reason for collecting personal data,
- Rights of the data subject.
Çalık Group will inform data subjects regarding the processing of their personal data through different tools within the scope of the obligation to inform. In addition, Çalık Group attaches importance to making publicly accessible policies understandable by personal data subjects. Information regarding the issues stated above is included on the web pages of Çalık Group Companies.
Which tools will be used regarding how data subjects will be informed are determined by internal policies.
Which tools will be used regarding how data subjects will be informed are determined by internal policies.
5.2 Obligation to Provide Information
Pursuant to Article 11 of KVKK, the rights of the data subject from whom personal data is obtained regarding the protection of personal data are as specified in Section 11 of this Policy. Pursuant to Article 13 of KVKK, Çalık Group is obliged to inform data subjects by evaluating requests submitted regarding these rights, and this notification will be carried out within the period determined under legal legislation.
Said requests must be submitted to Çalık Group in writing by data subjects or by other methods to be determined by the Board. Çalık Group strives to provide more opportunities to the data subject regarding applications, without prejudice to the Board's decisions on this matter.
Said requests must be submitted to Çalık Group in writing by data subjects or by other methods to be determined by the Board. Çalık Group strives to provide more opportunities to the data subject regarding applications, without prejudice to the Board's decisions on this matter.
5.3 Obligation to Ensure Data Security
Çalık Group's obligations regarding data security arising from Article 12 of KVKK in its capacity as data controller are specified in Section 10 of this Policy.
5.4 Obligation to Register with the Data Controllers Registry
Çalık Group is obliged to register with the Data Controllers Registry within the period determined and announced by the Board pursuant to Article 16 of KVKK.
Pursuant to Article 16/3 of KVKK, an exception to the obligation to register with the registry may be granted for some Group Companies, taking into account objective criteria to be determined by the Board such as the nature and number of processed personal data, whether data processing originates from law, or the status of transfer to third parties.
Pursuant to Article 16/3 of KVKK, an exception to the obligation to register with the registry may be granted for some Group Companies, taking into account objective criteria to be determined by the Board such as the nature and number of processed personal data, whether data processing originates from law, or the status of transfer to third parties.
6. CLASSIFICATION OF PERSONAL DATA
6.1 Personal Data
KVKK defines personal data as any information relating to an identified or identifiable natural person. In this context, the person's data must be identified or identifiable (reaching the person when combined with another piece of information). Information such as a person's name, surname, date and place of birth, identity card number, social security number, phone number, address, images, payment details, health information, and similar information fall within the definition of personal data.
The subject of KVKK is natural persons whose data are processed; legal entities are excluded from the scope. Therefore, information that does not contain information belonging to a natural person, such as a legal entity's registry number, trade title, and registry information, is not protected as personal data pursuant to KVKK.
The subject of KVKK is natural persons whose data are processed; legal entities are excluded from the scope. Therefore, information that does not contain information belonging to a natural person, such as a legal entity's registry number, trade title, and registry information, is not protected as personal data pursuant to KVKK.
6.2 Special Categories of Personal Data
Special categories of personal data are data of such nature that, if learned, may cause victimization or discrimination of the data subject; they are listed in the first paragraph of Article 6 of KVKK as follows: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, clothing and attire, membership to associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data. Processing of special categories of personal data without the explicit consent of the data subject is prohibited, except in cases explicitly authorized by law.
In this context, such personal data are not processed by Çalık Group except in cases permitted for processing under KVKK, or are processed upon obtaining explicit consent of the data subject in accordance with the conditions specified pursuant to Article 6 of KVKK.
In this context, such personal data are not processed by Çalık Group except in cases permitted for processing under KVKK, or are processed upon obtaining explicit consent of the data subject in accordance with the conditions specified pursuant to Article 6 of KVKK.
7. PERSONAL DATA PROCESSING POLICY
7.1 Principles to be Complied with Regarding the Processing of Personal Data
All collected personal data must be processed in accordance with the principles listed in Article 4 of KVKK and in compliance with the conditions specified in Articles 5 and 6. Pursuant to Article 4 of KVKK, Çalık Group is responsible for processing personal data in accordance with law and good faith rules, accurately and kept up to date when necessary, pursuing specific, explicit, and legitimate purposes, relevant, limited, and proportionate to the purpose, and retaining them for the period stipulated in relevant legislation or required for the purpose for which they are processed.
This means that:
This means that:
- Çalık Group is obliged to act in accordance with the principles stipulated by laws and other legal regulations during the processing of personal data.
- Çalık Group must be transparent during the processing of personal data as required by good faith rules, and comply with the obligation to inform and enlighten.
- Çalık Group must process personal data for legitimate and specific reasons, i.e., only for purposes that are legally explicit, specific, and lawful.
- Çalık Group must process personal data depending on the activities it carries out.
- Çalık Group must process personal data to the extent necessary. In this context, the principle of proportionality must be taken into account and personal data must not be used beyond what the purpose requires. Furthermore, processing unneeded or unnecessary personal data by exceeding the measure required to achieve the purpose must be avoided.
- Çalık Group must retain personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed (see Section 9) and must not store these data without anonymizing them for any reason despite the expiration of this period. If no period is specified in the legislation regarding personal data, reasonable retention periods should be determined considering the purpose of data usage and company procedures, and data should be stored limited to this period. Following the expiration of said periods, personal data must be deleted, destroyed, or anonymized in line with company procedures.
7.2 Çalık Group's Purposes for Processing Personal Data
Çalık Group processes personal data limited to the purposes and conditions within the personal data and special category personal data processing conditions specified in Articles 5 and 6 of KVKK. These purposes and conditions are as follows:
- It is explicitly provided for by law for Çalık Group to engage in the relevant activity regarding personal data processing,
- Processing of personal data by Çalık Group is directly related to and necessary for the establishment or performance of a contract,
- Processing of personal data is mandatory for Çalık Group to fulfill its legal obligation,
- Processing by Çalık Group limited to the purpose of publicizing, provided that personal data have been made public by data subjects,
- Processing of personal data by Çalık Group is mandatory for the establishment, exercise, or protection of rights of Çalık Group, data subjects, or third parties,
- It is mandatory to engage in personal data processing activities for the legitimate interests of Çalık Group, provided that it does not harm the fundamental rights and freedoms of data subjects,
- Engaging in personal data processing activities by Çalık Group is mandatory for the protection of life or physical integrity of the personal data subject or another person, and in this case, the personal data subject is unable to express consent due to actual or legal invalidity,
- It is stipulated by law in terms of special categories of personal data other than health and sexual life of the personal data subject,
- In terms of special categories of personal data regarding health and sexual life of the personal data subject, it is processed by persons under confidentiality obligations or authorized institutions and organizations for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and financing.
In this scope, Çalık Group processes your personal data for the following purposes:
- Planning, auditing, and execution of information security processes,
- Planning and execution of corporate sustainability activities,
- Event management,
- Management of relations with business partners or suppliers,
- Execution of Çalık Group recruitment processes,
- Supporting recruitment processes of Holding and Group Companies,
- Execution/monitoring of Çalık Group financial reporting and risk management transactions,
- Execution/monitoring of Çalık Group legal affairs,
- Planning and execution of corporate communication activities,
- Planning and execution of corporate governance activities,
- Execution of corporate and partnership law transactions,
- Request and complaint management,
- Ensuring the security of Çalık Group assets,
- Supporting Group Companies regarding compliance with relevant legislation,
- Supporting the planning and execution processes of fringe benefits and advantages to be provided to senior executives of Çalık Group,
- Planning and execution of audit activities to ensure that activities of Group Companies are carried out in accordance with Çalık Holding procedures and relevant legislation,
- Supporting Group Companies in conducting corporate and partnership law transactions,
- Carrying out studies aimed at protecting the reputation of Çalık Group,
- Managing investor relations,
- Providing information arising from legislation to authorized bodies,
- Creating and tracking visitor records.
If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under KVKK, explicit consent of the data subject is requested by Çalık Holding regarding the relevant processing operation.
7.3 Ensuring Lawful Processing of Personal Data
- Taking technical measures for lawful processing of personal data by Çalık Group,
- Establishing internal company organization for processing and storing personal data in compliance with the law,
- Creating technical infrastructure to ensure the security of databases where personal data will be stored,
- Ensuring the auditing of the established technical infrastructure and processes,
- Determining procedures regarding reporting of taken technical measures and audit processes
is an obligation.
Çalık Group also takes the following administrative measures for lawful processing of personal data:
Çalık Group also takes the following administrative measures for lawful processing of personal data:
- Informing and training company employees on the lawful protection and processing of personal data,
- Recording measures to be taken in case of unlawful processing of personal data by company employees in contracts, documents, or policies made with company employees,
- Auditing personal data processing activities of data processors and partners worked with.
8. PERSONAL DATA TRANSFER POLICY
8.1 Domestic Transfer of Personal Data
Çalık Group is obliged to act in accordance with decisions and regulations stipulated in KVKK and taken by the Board regarding the transfer of personal data. Personal data and special category data belonging to data subjects cannot be transferred to other natural or legal persons by Çalık Group without the explicit consent of the data subject.
Provided that, in cases where KVKK and other relevant legislation render it mandatory, data may be transferred to authorized administrative or judicial institutions and organizations without explicit consent, limited to the manner and boundaries stipulated in the legislation.
Furthermore, as stipulated in Article 8 of KVKK, data may be transferred without consent of the data subject in cases stipulated in paragraph two of Article 5 of KVKK (for example, if mandatory for the establishment or performance of a contract or fulfillment of our legal obligation) or in paragraph three of Article 6 of KVKK for special categories of personal data. Çalık Group may transfer personal data to third parties located in Turkey in accordance with conditions stipulated by law and by taking all necessary security measures.
Provided that, in cases where KVKK and other relevant legislation render it mandatory, data may be transferred to authorized administrative or judicial institutions and organizations without explicit consent, limited to the manner and boundaries stipulated in the legislation.
Furthermore, as stipulated in Article 8 of KVKK, data may be transferred without consent of the data subject in cases stipulated in paragraph two of Article 5 of KVKK (for example, if mandatory for the establishment or performance of a contract or fulfillment of our legal obligation) or in paragraph three of Article 6 of KVKK for special categories of personal data. Çalık Group may transfer personal data to third parties located in Turkey in accordance with conditions stipulated by law and by taking all necessary security measures.
8.2 Transfer of Personal Data Abroad
Çalık Group may transfer personal data to third parties in Turkey, or abroad to be processed in Turkey or processed and retained outside Turkey. In exceptional cases where explicit consent is not sought for transfer of personal data specified in KVKK, in addition to non-consent processing and transfer conditions, the condition of adequate protection in the country to which data will be transferred is sought. The Board will determine whether adequate protection is provided according to mandatory provision of KVKK; in case of absence of adequate protection, data controllers both in Turkey and in the relevant foreign country must undertake adequate protection in writing and obtain permission from the Board.
8.3 To Which Persons/Organizations Transfers Are Made
Authorized institutions and organizations:
Information requested by public legal entities, legally authorized private persons or organizations within the scope of relevant legislation is shared pursuant to Article 8/1 of KVKK.
Other persons or organizations to which personal data may be transferred for the purposes specified in Section 7.2 are; subsidiaries and/or direct/indirect domestic/foreign affiliates to be jointly and severally responsible with Çalık Group in taking data security measures such as retaining all kinds of personal data, preventing unauthorized access, and preventing unlawful processing, as well as domestic/foreign organizations and other third parties from which services are received, collaborated with, or program partners under relevant contracts to carry out activities as Çalık Group.
Information requested by public legal entities, legally authorized private persons or organizations within the scope of relevant legislation is shared pursuant to Article 8/1 of KVKK.
Other persons or organizations to which personal data may be transferred for the purposes specified in Section 7.2 are; subsidiaries and/or direct/indirect domestic/foreign affiliates to be jointly and severally responsible with Çalık Group in taking data security measures such as retaining all kinds of personal data, preventing unauthorized access, and preventing unlawful processing, as well as domestic/foreign organizations and other third parties from which services are received, collaborated with, or program partners under relevant contracts to carry out activities as Çalık Group.
8.4 Measures Taken by Çalık Group Regarding Lawful Transfer of Personal Data
Measures taken from a technical perspective:
- Takes measures to prevent unauthorized access and use of processed and transferred personal data, or data received as a result of transfer, by different Group Companies within Çalık Group, by different departments within said Group Companies, and by natural or legal persons processing personal data on its behalf within the scope of responsibility and authority arising from KVKK.
Measures taken from an administrative perspective:
- An internal policy has been established by different Group Companies within Çalık Group regarding how and for what processing purpose access to personal data should be granted to whom by different departments within said Group Companies and by natural or legal persons processing personal data on its behalf within the scope of responsibility and authority arising from KVKK.
9. PERSONAL DATA RETENTION POLICY
9.1 Retaining for the Period Stipulated in Relevant Legislation or Required for the Purpose for Which They Are Processed
Pursuant to Article 7 of KVKK and Article 138 of Turkish Penal Code No. 5237, Çalık Group retains processed personal data only for the period stipulated in relevant legislation or required by personal data processing purpose if no period is stipulated in legislation. Retained data will be deleted after the purpose of retaining data ceases, and while this period is determined as an average of 2 years, data for which a longer period is stipulated by legislation will continue to remain in the system for the period specified in legislation.
For this reason, a different retention period may apply for each personal data regarding the period stipulated in relevant legislation or required for the purpose for which they are processed. For example, pursuant to Article 253 of Tax Procedural Law No. 213, books and documents must be retained for 5 years.
Another example is that pursuant to Regulation on Commercial Communication and Commercial Electronic Messages published in Official Gazette dated July 15, 2015 and numbered 29417, in cases where data subject approval regarding use of personal data for marketing or promotional purposes is withdrawn, personal data records must be stored for 1 year from this date. The content of commercial electronic messages and all other records regarding dispatch will be stored for 3 years to be submitted to relevant ministry when necessary.
On the other hand, data may have been processed for multiple purposes, and in such case, when all reasons causing processing of relevant data disappear, relevant data is deleted, destroyed, or retained by anonymization.
For this reason, a different retention period may apply for each personal data regarding the period stipulated in relevant legislation or required for the purpose for which they are processed. For example, pursuant to Article 253 of Tax Procedural Law No. 213, books and documents must be retained for 5 years.
Another example is that pursuant to Regulation on Commercial Communication and Commercial Electronic Messages published in Official Gazette dated July 15, 2015 and numbered 29417, in cases where data subject approval regarding use of personal data for marketing or promotional purposes is withdrawn, personal data records must be stored for 1 year from this date. The content of commercial electronic messages and all other records regarding dispatch will be stored for 3 years to be submitted to relevant ministry when necessary.
On the other hand, data may have been processed for multiple purposes, and in such case, when all reasons causing processing of relevant data disappear, relevant data is deleted, destroyed, or retained by anonymization.
9.2 Measures Taken by Çalık Group Regarding Retention of Personal Data
Personal data processed in accordance with KVKK and other relevant legislative provisions must be deleted, destroyed, or anonymized directly or upon request of data subject by Çalık Group in a manner that these data can never be used or restored, if reasons requiring processing disappear. Procedures and principles regarding lawful destruction or anonymization of personal data will be fulfilled in accordance with principles and rules to be specified in regulation to be issued pursuant to Personal Data Protection Law.
Measures taken from a technical perspective:
Measures taken from a technical perspective:
- Necessary systems and control mechanisms regarding deletion, destruction, and anonymization of personal data are established by Çalık Group.
Measures taken from an administrative perspective:
- Çalık Group, based on responsibility and authority arising from KVKK, informs natural or legal persons processing personal data on behalf of Group regarding lawful retention of personal data and creates awareness; at the same time, ensures that they take measures regarding lawful retention, deletion, destruction, or anonymization of personal data within framework of contracts concluded with these persons.
- Çalık Group is responsible for auditing personal data retention activities carried out by natural or legal persons processing personal data on behalf of Group based on responsibility and authority arising from KVKK.
10. PERSONAL DATA SECURITY POLICY
10.1 Çalık Group's Obligations Regarding Data Security
Pursuant to Article 12 of KVKK, obligations of Çalık Group regarding data security as data controller are as follows:
To take all technical and administrative measures to:
To take all technical and administrative measures to:
- Prevent unlawful processing of personal data,
- Prevent unlawful access to personal data,
- Ensure retention of personal data,
and is obliged to:
- Conduct or cause to be conducted necessary audits within its organization,
- Take necessary measures to ensure that persons processing personal data on its behalf or officials serving in its bodies do not disclose personal data learned during their duties to others contrary to provisions of law and do not use them outside purpose of processing, even if they leave their duties,
- Notify data subject and Board if processed personal data are unlawfully obtained by others.
.
10.2 Measures Taken by Çalık Group Regarding Data Security
In terms of fulfilling obligations regarding security of personal data and acting rapidly in cases where security poses a risk, Çalık Group takes measures listed below:
10.2.1. Technical and administrative measures taken to prevent unlawful access to personal data
Technical and administrative measures required to be taken in relevant sections regarding processing, transfer, and retention of personal data are listed. Although Çalık Group is obliged to take these measures completely and prevent unlawful access; if unlawful access to personal data by third parties occurs despite this; it takes all technical and administrative measures in accordance with relevant legislation and Board decisions regarding protection of personal data to prevent harm to data subjects.
10.2.2. Measures taken regarding protection of personal data and their auditing
Whether data recording systems used within company are created and used in accordance with KVKK and relevant legislation is periodically monitored and audited, and reporting is made to authorized person or board in this regard.
Çalık Group is obliged to inform natural or legal persons processing personal data on its behalf based on authorization given by it regarding lawful protection of personal data and create awareness; at the same time, determine provisions for lawful protection of personal data within framework of contracts concluded with these persons.
Çalık Group is obliged to inform natural or legal persons processing personal data on its behalf based on authorization given by it regarding lawful protection of personal data and create awareness; at the same time, determine provisions for lawful protection of personal data within framework of contracts concluded with these persons.
10.2.3. Measures to be taken in case of unauthorized disclosure of personal data
Çalık Group is obliged to take measures to prevent unauthorized disclosure of personal data and establish internal policy regarding this. In addition, in such cases, Çalık Group, as data controller, is obliged to inform persons whose personal data were disclosed without authorization and the Board.
11. RIGHTS OF THE DATA SUBJECT
11.1 Right to Access Personal Data
Data subjects have right to access their personal data free of charge. Therefore, Çalık Group informs data subject that they have right to:
- Learn whether personal data are processed,
- Request information if personal data have been processed,
- Learn purpose of processing personal data and whether they are used in accordance with purpose,
- Request to know third parties to whom personal data are transferred domestically or abroad.
.
11.2 Right to Modify or Request Deletion of Personal Data
Data subjects have right to modify or request deletion of personal data free of charge.
In this scope, data subject has right to:
In this scope, data subject has right to:
- Request correction of personal data if incomplete or inaccurately processed,
- Request deletion or destruction of personal data if reasons requiring processing disappear,
- Request notification of abovementioned correction, deletion, or destruction operations to third parties to whom personal data were transferred,
- Object to occurrence of a result against person by analyzing processed data exclusively through automated systems.
.
11.3 Ensuring Accuracy and Timeliness of Personal Data
Pursuant to KVKK, there is an obligation to ensure personal data are accurate and up to date when necessary; for this reason, current status changes must be notified to Çalık Group by data subject (by sending via registered letter with return receipt or through notary public with identity confirming and verification documents attached to address Büyükdere Cd. No:163 34394 Zincirlikuyu) in terms of keeping personal data accurate and up to date.
12. RESPONSE TO APPLICATIONS BY ÇALIK HOLDİNG A.Ş.
Applications regarding personal data processing activities of Group Companies must be made to relevant Group Company. Application to Çalık Holding must be made only in cases where Çalık Holding is considered data controller under KVKK. This situation may exist in cases where Çalık Holding collects personal data directly from data subject or data sharing between relevant Group Company and Çalık Holding is considered data controller to data controller transfer under KVKK. Apart from these, applications regarding personal data processing activities where relevant Group Company is considered data controller must be made to relevant Group Company, not to Çalık Holding.
12.1 Procedure and Period of Response to Applications by Çalık Group
Data subjects will be able to make requests to Çalık Group to ensure access to personal data processed by Çalık Group in shortest time and towards exercising rights stated above. Çalık Group creates necessary application channels to fulfill these access requests. Applications are answered in shortest time and in any case within period stipulated in KVKK.
Data subjects must apply to representative to be announced by Çalık Group and declared in Data Controllers Registry when legal infrastructure is provided. Data controller representative will conclude requests regarding processing and protection of personal data depending on nature as soon as possible and in any case within 30 days at latest free of charge or against fee in tariff if conditions in tariff to be published by Board regarding fee occur.
In order for this period to start, requests made by data subjects must be sent to data representative in writing or by other methods determined by Board and also transmitted by attaching documents confirming and verifying identity of data owner. Applications to be made until a method is determined by Board must be made in writing. During application to be made by data subject, data subject must clearly state which right is exercised and send it with information and documents, if any, to corporate address of Çalık Holding A.Ş. Büyükdere Cd. No:163, 34394, Zincirlikuyu - İstanbul via registered letter with return receipt or through notary public.
Requests made by data subject are accepted or rejected with explanation of reason by data controller representative, and response is notified in writing or electronically. If application is accepted, necessary action is taken by Çalık Group and if it arises from fault of Çalık Group, collected fee is refunded to data subject. In some cases regarding request for processing/ modification/ deletion of personal data, request is not responded positively due to legal obligations or in line with other reasons determined pursuant to Articles 5 and 6 of KVKK. In this case, legal basis will be notified by detailing reasons in rejection response to be given.
In cases where application is rejected by Çalık Group, response given is found insufficient, or response is not given in time; data subject has right to lodge complaint with Board within 30 days from date response learned and in any case within 60 days from application date.
Data subjects must apply to representative to be announced by Çalık Group and declared in Data Controllers Registry when legal infrastructure is provided. Data controller representative will conclude requests regarding processing and protection of personal data depending on nature as soon as possible and in any case within 30 days at latest free of charge or against fee in tariff if conditions in tariff to be published by Board regarding fee occur.
In order for this period to start, requests made by data subjects must be sent to data representative in writing or by other methods determined by Board and also transmitted by attaching documents confirming and verifying identity of data owner. Applications to be made until a method is determined by Board must be made in writing. During application to be made by data subject, data subject must clearly state which right is exercised and send it with information and documents, if any, to corporate address of Çalık Holding A.Ş. Büyükdere Cd. No:163, 34394, Zincirlikuyu - İstanbul via registered letter with return receipt or through notary public.
Requests made by data subject are accepted or rejected with explanation of reason by data controller representative, and response is notified in writing or electronically. If application is accepted, necessary action is taken by Çalık Group and if it arises from fault of Çalık Group, collected fee is refunded to data subject. In some cases regarding request for processing/ modification/ deletion of personal data, request is not responded positively due to legal obligations or in line with other reasons determined pursuant to Articles 5 and 6 of KVKK. In this case, legal basis will be notified by detailing reasons in rejection response to be given.
In cases where application is rejected by Çalık Group, response given is found insufficient, or response is not given in time; data subject has right to lodge complaint with Board within 30 days from date response learned and in any case within 60 days from application date.
12.2 Information Çalık Group May Request from Applying Personal Data Subject
Çalık Group may request information from applicant to determine whether applicant is personal data subject. Çalık Group may direct questions to personal data subject regarding application to clarify matters in application of personal data subject.
12.3 Çalık Group's Right to Reject Application of Personal Data Subject
Çalık Group may reject application of applicant by explaining reason in following cases:
- Processing of personal data by natural persons completely within scope of activities related to themselves or family members living in same dwelling, provided that data are not given to third parties and obligations regarding data security are complied with,
- Processing of personal data for purposes such as research, planning, and statistics by anonymizing with official statistics,
- Processing of personal data for artistic, historical, literary, or scientific purposes or within scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life, or personal rights or constitute a crime,
- Processing of personal data within scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,
- Processing of personal data by judicial authorities or execution authorities regarding investigation, prosecution, trial, or execution proceedings,
- Processing of personal data is necessary for prevention of crime or crime investigation,
- Processing of personal data made public by personal data subject themselves,
- Processing of personal data is necessary for execution of supervision or regulation duties or disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations in nature of public institution based on authority granted by law,
- Processing of personal data is necessary for protection of economic and financial interests of State regarding budget, tax, and financial matters,
- Possibility that request of personal data subject may hinder rights and freedoms of other persons,
- Requests requiring disproportionate effort have been made,
- Requested information is publicly available information.
13. RELATIONSHIP OF ÇALIK GROUP PERSONAL DATA PROTECTION AND PROCESSING POLICY WITH OTHER POLICIES
Çalık Group may create sub-policies for internal use as well as fundamental policies for Group Companies regarding protection and processing of personal data to which principles set forth by this Policy relate.
Principles of internal policies of Çalık Group are reflected in publicly available policies to extent relevant, aiming to ensure transparency and accountability regarding personal data processing activities carried out by Çalık Group by informing data subjects in this framework.
Principles of internal policies of Çalık Group are reflected in publicly available policies to extent relevant, aiming to ensure transparency and accountability regarding personal data processing activities carried out by Çalık Group by informing data subjects in this framework.
14. PUBLICATION AND RETENTION OF DOCUMENT
This data policy will be notified to users whose personal data exist together with obligation to inform under KVKK and will also be published on sites affiliated with Çalık Group.
15. UPDATE PERIOD
In case of changes made in line with economic and commercial decisions of Çalık Group or principle decisions of Personal Data Protection Board, this situation will be notified to our members whose data are recorded via method they registered.
16. ENFORCEMENT
This data policy enters into force on date of publication and remains in force until removed from website.
Sincerely,
Sincerely,
