Privacy Policy

KOMTERA TEKNOLOJİ A.Ş. PRIVACY POLICY

Within the scope of the Personal Data Protection Law, we at Komtera Teknoloji A.Ş. attach great importance to the protection of your personal data and/or special categories of personal data. We take great care in the storage of all your personal data and/or special categories of personal data transmitted to our company through various channels.

In this context, Komtera Teknoloji A.Ş. has taken the necessary technical and administrative measures to comply with the Constitution of the Republic of Türkiye and other applicable legislation, first and foremost Law No. 6698 on the Protection of Personal Data. We would also like to emphasise that we will protect your rights as guaranteed by law. You can therefore share your data with Komtera Teknoloji A.Ş. with confidence and send us your suggestions, complaints and concerns.

Komtera Teknoloji A.Ş. places particular importance on the protection of your personal data, and we hereby share with you the Privacy Policy that has been put into effect within our company.

Komtera Teknoloji A.Ş.

1. DEFINITIONS

Data Controller: Komtera Teknoloji A.Ş., which determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

Data Subject (Relevant Person): The natural person whose personal data is processed.

Company: Komtera Teknoloji A.Ş., for the purposes of this Policy.

Law: Law No. 6698 on the Protection of Personal Data.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Board: The Personal Data Protection Board.

Policy: This Privacy Policy.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether by wholly or partly automated means, or by non-automated means provided that it forms part of a data filing system.

Explicit Consent: Freely given, informed consent relating to a specific matter.

Destruction: Rendering personal data inaccessible, irretrievable and unusable by anyone in any way.

Deletion: Rendering personal data inaccessible and unusable in any way for the relevant users.

Anonymisation: Rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even when matched with other data.

Disposal: The deletion, destruction or anonymisation of personal data.

Data: Personal data and special categories of personal data, collectively.

2. PURPOSE OF THE PRIVACY POLICY

Protecting personal data and complying with the law is our fundamental principle. In all of our work as Komtera Teknoloji A.Ş. (hereinafter “Komtera Teknoloji” or the “Company”), the personal data and/or special categories of personal data we have received from you have been kept confidential and have not been shared with third parties. Our company has always shown due care regarding the protection of personal data and/or special categories of personal data.

Furthermore, our internal regulations have been revised in accordance with Law No. 6698 on the Protection of Personal Data (hereinafter the “Law” or “KVKK”), and technical and administrative measures have been taken. Going forward, Komtera Teknoloji accepts, declares and undertakes to comply with the obligations imposed by the Law.

3. SCOPE OF THE PRIVACY POLICY

This Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data. Your personal data and/or special categories of personal data are processed with your consent or on the lawful grounds set out in the Law. Some of the personal data and/or special categories of personal data we receive from you are de-identified and anonymised in accordance with the procedures prescribed by the Law. Data used for statistical purposes is not subject to the Law or to the scope of this Policy.

Komtera Teknoloji reserves the right to amend this Policy for the purpose of protecting personal data in compliance with the Law.

This Privacy Policy aims to protect the data, obtained by any means, of the natural and legal persons with whom Komtera Teknoloji partners, as well as its customers, employees and all other persons. To achieve this aim, it contains a number of provisions.

4. BASIC PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Our basic principles for the processing of personal data and/or special categories of personal data are set out below. These principles apply to all data processed by Komtera Teknoloji on the basis of explicit consent or on lawful grounds under the Law.

Lawfulness: Komtera Teknoloji examines the source and lawfulness of the personal data and/or special categories of personal data it receives from natural and legal persons and collects through various channels. Obtaining data lawfully is therefore of great importance to Komtera Teknoloji.

Fairness (Good Faith): Komtera Teknoloji examines the source of the personal data and/or special categories of personal data it receives from natural and legal persons and collects through various channels. Obtaining data in good faith is therefore of great importance to Komtera Teknoloji.

Limited, Proportionate and Relevant to the Purpose of Processing: Komtera Teknoloji uses the personal data and/or special categories of personal data it obtains through various channels in a manner that is appropriate to, limited by and proportionate to the purpose of processing, and only to the extent required to deliver the service.

Accuracy of Personal Data and/or Special Categories of Personal Data: Komtera Teknoloji attaches importance to ensuring that the personal data and/or special categories of personal data it receives from natural and legal persons and collects through various channels are accurate and free of incorrect information. However, Komtera Teknoloji is not obliged to verify the accuracy of the personal data and/or special categories of personal data declared by its customers or by the natural and legal persons with whom it is in contact, as this is not possible either legally or under our working principles.

Kept Up to Date Where Necessary: Where there has been a change in the personal data and/or special categories of personal data obtained by Komtera Teknoloji, Komtera Teknoloji attaches importance to that change being communicated to the Company and, once communicated, to the data being updated.

Processing for Specified and Legitimate Purposes: Komtera Teknoloji processes personal data and/or special categories of personal data either with the explicit consent of the data subject or, without explicit consent, within the exceptions provided by law. The purpose of processing each item of data is specified, and no personal data processing is carried out for any illegitimate purpose.

Retained for the Period Prescribed by Law and/or Required for the Purpose of Processing: Komtera Teknoloji retains the personal data and/or special categories of personal data it obtains for the periods prescribed in the relevant legislation and/or required for the purposes for which they are processed. When those purposes cease to exist, the data is anonymised, destroyed or deleted.

5. DELETION, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA

Your personal data and/or special categories of personal data are deleted, destroyed or anonymised upon the expiry of the limitation and retention periods prescribed by law, the conclusion of judicial proceedings, or the cessation of other requirements relevant to the purpose. Deletion, destruction and anonymisation are carried out at the request of the relevant data subject or ex officio (on its own initiative) by Komtera Teknoloji.

6. DATA MINIMISATION PRINCIPLE

The data minimisation principle is also known as the principle of maximum economy. Personal data and/or special categories of personal data received through various channels are transferred into our company’s systems. Under this principle, data is processed into the system only to the extent necessary.

The data to be collected by Komtera Teknoloji is determined according to the purpose and therefore varies. Data is collected in line with the purpose, and data that is not relevant to the purpose is not collected. Excess data beyond the purpose is not recorded in the Company’s systems; it is deleted, destroyed or anonymised. Such data may, however, be used for statistical purposes.

7. CONFIDENTIALITY AND SECURITY OF DATA

At Komtera Teknoloji, we attach importance to the confidentiality of your personal data and/or special categories of personal data. Accordingly, your personal data and/or special categories of personal data reaching our company by any means are confidential. Komtera Teknoloji observes the confidentiality of such data at every stage of its commercial activities, and full compliance with this company Privacy Policy is ensured.

The necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various channels from falling into the hands of unauthorised persons, to ensure that data subjects’ rights are not harmed and that they are not aggrieved, and to protect the data. In addition, where necessary, data protection is also required of the third parties with whom we lawfully share personal data and/or special categories of personal data.

Our software is also updated and continuously renewed. Technological requirements are fulfilled and compliance with standards is ensured in order to provide a high level of protection.

8. DATA BEING UP TO DATE

The principle of keeping data up to date is fundamental at Komtera Teknoloji. Personal data and/or special categories of personal data obtained in various ways can be updated where necessary or upon request. Komtera Teknoloji also takes the necessary measures relating to such updates.

9. ACCURACY OF DATA

Komtera Teknoloji has adopted the principle that declared personal data and/or special categories of personal data are accurate. Komtera Teknoloji is not obliged to verify the accuracy of the personal data and/or special categories of personal data declared by its customers or by the natural and legal persons with whom it is in contact, as this is not possible either legally or under our working principles. Processing is therefore carried out on the basis that the declared data is accurate.

10. PURPOSES OF PROCESSING PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Personal data and/or special categories of personal data are processed in line with the purposes set out in Komtera Teknoloji’s Information Notices. These Information Notices may vary according to the personal data and/or special categories of personal data being processed, and the purposes of processing may vary accordingly.

11. PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA FOR ADVERTISING PURPOSES

Electronic messages sent for advertising purposes are governed by the Law on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. When sending commercial electronic messages for advertising purposes, Komtera Teknoloji acts in accordance with the above legislation. In line with that legislation, consent is obtained where required and the details of the consent are observed. Such consent may be obtained through any electronic communication channel or in writing in physical form.

In addition, before any commercial electronic message is sent, individuals are informed that their data may be processed and, where necessary, their explicit consent is obtained. Commercial messages are thus also sent in compliance with the provisions of Law No. 6698 on the Protection of Personal Data.

12. COLLECTION AND PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA WITHIN A CONTRACTUAL RELATIONSHIP

Where a contractual relationship has been established with customers or prospective customers, personal data collected under the contract may be processed by Komtera Teknoloji without obtaining explicit consent. Where special categories of personal data are to be processed, they may be processed on the basis of explicit consent or the legal grounds set out in Article 6 of the Law. Such data is used for the delivery of goods and/or services, the performance of the contract and the conduct of commercial activities. This data may be updated at any time by contacting customers.

13. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED BY AUTOMATED SYSTEMS

Data derived from information obtained through automated systems without the explicit consent of individuals may not be used against them. Komtera Teknoloji acts in accordance with the relevant legislation with regard to personal data and/or special categories of personal data processed by automated systems.

14. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA OF KOMTERA TEKNOLOJİ A.Ş. EMPLOYEES

Processing Within the Framework of Legal Obligations

Employees’ personal data may be processed by Komtera Teknoloji without their explicit consent where the processing is expressly provided for by the relevant law or is necessary for the data controller to fulfil a legal obligation.

Processing of Personal Data Under the Employment Contract and Employment Relationship

Employees’ personal data may be processed without their explicit consent, proportionately and to the extent necessary to maintain the employment relationship between the Company and its employees. Komtera Teknoloji undertakes in all circumstances to protect employees’ data, to keep it confidential and to take the necessary measures in this regard.

Processing of Employees’ Special Categories of Personal Data

Under Law No. 6698 on the Protection of Personal Data, the processing of special categories of personal data requires the explicit consent of the person concerned and, in addition, the adequate measures prescribed by the Board. When processing special categories of personal data in compliance with Law No. 6698 and the principles of the Board, Komtera Teknoloji obtains, where necessary, both the explicit consent of the person concerned and the measures determined by the Board. However, in the exceptional cases provided for by the Law, special categories of personal data may be processed without the explicit consent of the person concerned, provided that the processing is limited and proportionate.

Personal Data Processed by Automated Systems

Some of employees’ personal data may be processed in automated systems. Such data is used for employee performance evaluations, keeping statistical records, and for promotions and scoring within the Company. Employees have the right to object to any adverse outcome concerning them. Objections must be made in accordance with internal company rules and procedures and are evaluated within the Company.

Processing of Personal Data for the Benefit of Employees

Employees’ personal data may be processed by Komtera Teknoloji without explicit consent, within the framework of the employment contract, for transactions in the employee’s interest. The Company may also process employees’ personal data in the course of disputes relating to the employment relationship with Komtera Teknoloji.

Internal Telecommunications, Internet and Communication

To facilitate the performance of work, Komtera Teknoloji may allocate computers, telephones, cars, applications, software and e-mail accounts to its employees. Komtera Teknoloji may monitor and inspect personal data on the tools it allocates; in doing so, Komtera Teknoloji also fulfils the necessary Obligation to Inform.

Employees may not use the tools allocated to them for private purposes and must use them solely for the performance of their work. Furthermore, from the start of their working relationship with Komtera Teknoloji, employees accept, declare and undertake that they will not keep any data or information on the allocated tools other than that related to their work and its requirements.

15. DOMESTIC AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Komtera Teknoloji may transfer data within Türkiye and abroad in accordance with the conditions set out in the Personal Data Protection Law and the principles determined by the Board, on lawful grounds or with the explicit consent of the person concerned. When transferring personal data and/or special categories of personal data, Komtera Teknoloji acts in accordance with Articles 8 and 9 of Law No. 6698, and also fulfils the necessary obligations to inform and to obtain explicit consent.

16. DOMESTIC AND INTERNATIONAL TRANSFER OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

The necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various channels from falling into the hands of unauthorised persons, to ensure that data subjects’ rights are not harmed and that they are not aggrieved, and to protect the data. In addition, where necessary, data protection is also required of the companies with whom we lawfully share personal data and/or special categories of personal data.

Our software is also updated, continuously renewed and developed. All technological requirements are fulfilled and compliance with standards is ensured in order to provide a high level of protection. In parallel, Komtera Teknoloji has all necessary internal and external audits carried out to protect personal data and/or special categories of personal data.

17. NOTIFICATION OF DATA BREACHES

In the event of any data breach, Komtera Teknoloji acts immediately to do its part in remedying the breaches reported to it, and takes the measures necessary to minimise any harm to the person concerned. You may report breaches by applying in accordance with the procedures set out on our company’s website.

In addition, if personal data and/or special categories of personal data are obtained by unauthorised third parties from outside, the Company notifies the Personal Data Protection Board of the matter directly.

18. RIGHTS OF THE DATA SUBJECT REQUESTING INFORMATION

A. General Information on Applications and Your Rights

Article 11 of Law No. 6698 on the Protection of Personal Data sets out the rights of the data subject. The Law refers to the data subject as the “relevant person” and grants them the right to make certain requests regarding the processing of their data. Under this Article, the relevant person has the right to:

a) Learn whether their personal data is being processed,
b) Request information if their personal data has been processed,
c) Learn the purpose of processing and whether the data is used in accordance with that purpose,
ç) Know the third parties, in Türkiye or abroad, to whom their personal data has been transferred,
d) Request correction of personal data that is incomplete or inaccurately processed,
e) Request the deletion or destruction of their personal data under the conditions set out in Article 7 of the Law, titled “Deletion, destruction or anonymisation of personal data”,
f) Request that the operations carried out under sub-paragraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred,
g) Object to any outcome to their detriment arising from the analysis of the processed data exclusively by automated systems,
h) Claim compensation for damages suffered as a result of the unlawful processing of their personal data.

Komtera Teknoloji will respond to your requests concerning your rights under Law No. 6698 on the Protection of Personal Data, as explained above, as soon as possible depending on the nature of the request and within thirty days at the latest. Where the process entails an additional cost, Komtera Teknoloji reserves the right to charge a fee in accordance with the law, based on the tariff determined by the Personal Data Protection Board.

B. Application Procedure

You may submit your requests regarding the above rights to Komtera Teknoloji, as data controller, in writing together with a document proving your identity to “Atatürk mah. Kamil Bey sokak no:4 Ataşehir, 34642 İstanbul Türkiye”; by e-mail to [email protected] from the e-mail address registered in our system; by e-mail to our registered electronic mail (KEP) address ([email protected]) using a secure electronic signature or mobile signature; or by any other method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.

To exercise your rights regarding personal data, you may review the information provided on our website and use the “Information Request Form under Law No. 6698 on the Protection of Personal Data” available on our website.

C. Information to Be Included in the Application

Your application should include the following information:

Your name and surname
Your Turkish ID number
If you are a foreign national: your nationality, passport number or, if any, your ID number
If applying in writing: your wet signature at the bottom of the request form
The content and subject of your request under Article 11 of the KVKK
Telephone and fax number(s) at which we can contact you
Your e-mail address at which we can contact you
Your residential or business address for notifications