PDPA

PERSONAL DATA PROTECTION POLICY

In accordance with the Personal Data Protection Law No. 6698 (KVKK), your personal data will be processed by our Company as a Data Controller within the framework explained below for business purposes. In this context, our Company takes all necessary technical and administrative measures to ensure an appropriate level of security to prevent the unlawful processing, unlawful access, and preservation of your personal data, in accordance with the laws and regulations established to protect personal data and to safeguard the fundamental rights and freedoms of individuals, particularly the right to privacy.

The target audience of this text includes all individuals whose personal data is processed by our Company, excluding our employees or employee candidates who have applied for a job with our Company.

The personal data processed in the capacity of Data Controller include, but are not limited to:

Name, surname, Turkish ID number, address, phone number, email address, signature, physical space/security video recordings, call center/service quality voice recordings, bank account number, cookie records.

Purposes and Legal Grounds for Processing Personal Data:

The personal data you share with us may be processed for purposes including but not limited to:

To enable you and/or the institutions and organizations you represent to benefit from the products and services provided by our Company;
To determine and implement the commercial and business strategies of our Company, to carry out marketing activities, business development, and planning activities;
To manage administrative operations related to communication conducted by our Company;
To ensure the physical security and control of the locations used by our Company;
To establish relationships with business partners/customers/suppliers (their authorized representatives or employees);
To fulfill the requirements of contracts and financial reconciliation related to products and services provided in collaboration with our business partners, suppliers, or other third parties;
To implement the human resources policies of our Company;
To handle calls made to our Company's call center or the use of our website;
To participate in training, seminars, or events organized by our Company.

Method of Collecting and Storing Personal Data:

The personal data you share with us may be collected through automatic or non-automatic methods, verbally, in writing, or electronically, via offices, branches, call centers, websites, social media platforms, mobile applications, and similar means. Your personal data will be stored in electronic and/or physical environments. Necessary business process designs and technical security infrastructure developments are applied to ensure that your personal data obtained and stored by our Company are not exposed to unauthorized access, manipulation, loss, or damage in the environments where they are stored.

Your personal data will be processed and stored, with all necessary information security measures taken, for the duration required by the processing purpose or the legally mandated retention period. Once this period ends, your personal data will be deleted, destroyed, or anonymized by removing them from our Company's data flows.

Transfer of Personal Data:

Your personal data may be transferred to the following entities within the scope of the laws and regulations and for the purposes mentioned above:

Türk Telekomünikasyon A.Ş. and Türk Telekomünikasyon group companies;
Companies, representatives authorized to act on behalf of our Company;
Regulatory and supervisory authorities, public institutions or organizations authorized by law to request your personal data;
Business partners, suppliers, contractors, banks, credit risk and financial institutions, and other individuals or legal entities with whom we collaborate, for the purposes mentioned above;
Tax and similar consultants, individuals, institutions, and organizations related to legal follow-up processes, auditors, and third parties from whom we receive consultancy services, including but not limited to, individuals and organizations authorized for the purposes mentioned above.

Your Rights Under KVKK Article 11:

By applying to our Company, you have the right to:

Learn whether your personal data is processed,
Request information if your data has been processed,
Learn the purpose of processing and whether they are used for their intended purpose,
Know the third parties to whom your data has been transferred in the country or abroad,
Request correction if your data has been incompletely or incorrectly processed,
Request deletion or destruction of your data under the conditions specified in Article 7 of the KVKK,
Request notification of the transactions carried out under subparagraphs (e) and (f) to third parties to whom your data has been transferred,
Object to any results that are against you due to analysis by exclusively automated systems,
Request compensation if you suffer a loss due to the unlawful processing of your data.

To Exercise Your Rights:

In accordance with paragraph 1 of Article 13 of the Personal Data Protection Law, you may submit your request to exercise your above-mentioned rights in writing or by using other methods determined by the Personal Data Protection Board.

To exercise your rights, you may submit your request, along with the necessary information to identify yourself, in person by delivering it to our Company, through a notary, or by sending it with a secure electronic signature.