Law on the Protection of Personal Data

As the Digital Transformation and Sustainability Association, we place great importance on the privacy and security of your personal data.

In this context, processing and storing all types of personal data belonging to all individuals associated with the Digital Transformation and Sustainability Association, including our customers and business connections, in accordance with the Personal Data Protection Law No. 6698 (“KVKK”), is one of our priorities. In light of our role as a "Data Controller" under KVKK and our awareness of this responsibility, we would like to inform you about the purposes of processing your personal data, the methods and reasons for collecting your data, your rights regarding the processing of your personal data, and the application procedures and principles for exercising these rights as outlined below.

a. What is Personal Data? What Personal Data Do We Collect?

Personal data refers to any information that can be associated with your identity, including personal information such as your name, surname, Turkish Identification Number (T.C. Kimlik No), address and phone information, vehicle and license plate information, family status information, IP address, bank account information, and other similar data (“Personal Data”). Special Category Personal Data, which is a specific type of personal data, includes sensitive personal data such as race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance, membership in associations, foundations, or unions, health data, sexual life, criminal convictions, and security measures, as well as biometric and genetic data (“Special Category Personal Data”). The explanations we provide on this page regarding your Personal Data also cover your Special Category Personal Data.

In this context, as the Digital Transformation and Sustainability Association, we collect Personal Data of our customers, business connections, employees, job candidates, platform (internet/mobile sites and applications) users, visitors, subcontractors, and authorized and employee representatives of institutions with which we have similar business relationships in accordance with KVKK when necessary. We can detail the Personal Data we collect as follows:

• Identity Data: These are data related to a person's identity collected from our customers, business connections, employees, job candidates, platform (internet/mobile sites and applications) users, visitors, subcontractors, and authorized and employee representatives of institutions with which we have similar business relationships, such as name, surname, Turkish Identification Number (T.C. Kimlik No), and copies of identification documents.
• Contact Data: These are data that enable communication with individuals, collected from our customers, business connections, employees, job candidates, platform (internet/mobile sites and applications) users, visitors, and authorized and employee representatives of institutions with which we have similar business relationships, such as phone numbers, addresses, email addresses, and IP addresses.
• Data Related to Family Members: These are data about the family members and relatives of the relevant person, collected from our employees, job candidates, and authorized and employee representatives of institutions with which we have similar business relationships, in order to protect the legal and other interests of our company or the relevant individual as required by applicable legislation.
• Financial Data: These are data such as salary and bank account information collected from our employees, job candidates, customers, business connections, subcontractors, and authorized and employee representatives of institutions with which we have similar business relationships, based on the legal relationship established with the data subject.
• Personnel Data: These are all types of personal data that form the basis of personnel rights of natural persons who have a working relationship with our company, collected from our employees, job candidates, and authorized representatives of institutions with which we have similar business relationships.
• Physical Location Security Data: These are personal data such as security and camera recordings collected from our customers, business connections, employees, job candidates, visitors, and authorized and employee representatives of institutions with which we have similar business relationships during physical entry to and while staying within the premises.
• Communication and Complaint Management Data: These are personal data obtained from our customers, business connections, platform (internet/mobile sites and applications) users, visitors, and authorized and employee representatives of institutions with which we have similar business relationships during the processes of receiving and evaluating any type of requests or complaints directed towards our company.
• Special Category Personal Data: These are data such as health data, biometric data (voice and video recordings), religion, and membership information in associations or unions, collected from our customers, business connections, employees, job candidates, visitors, and authorized and employee representatives of institutions with which we have similar business relationships, as specified in Article 6 of KVKK.
• Other Data: These are data processed for technical transaction security, purchase information, cookies, and other means, as well as data collected automatically through various methods, collected from our customers, business connections, employees, job candidates, platform (internet/mobile sites and applications) users, and authorized and employee representatives of institutions with which we have similar business relationships.

b. How Do We Collect / Process Your Personal Data and What Are the Legal Grounds?

We collect your Personal Data through the following main purposes and methods, and through other channels that may be added in the future, using automated or non-automated means, verbally, orally, in writing, or electronically.

We collect your Personal Data through our internet and mobile platforms (internet/mobile sites and applications), social media accounts managed on behalf of the Digital Transformation and Sustainability Association on various social media platforms, our call center managed by the Digital Transformation and Sustainability Association, email, short messages (“SMS”), multimedia messages (“MMS”), and other communication methods, through contracts signed with you or your authorized company as part of our sales and marketing activities, commercial offers, printed and electronic forms, business visits where you provide business cards and other documents, through third parties such as group companies of the Digital Transformation and Sustainability Association, business connections, distributors and sales channels, manufacturing companies, or firms supplying services/products, and through various channels including sources like the Trade Registry, using methods that are fully or partially automated or as part of any data recording system.

We process the Personal Data we collect in accordance with one or more of the following legal grounds:

• Having your explicit consent,
• The provisions of laws and regulations in force in the Republic of Turkey allowing the processing,
• Being necessary to protect your or another person's life or physical integrity when it is impossible to obtain your consent due to practical impossibility,
• Being necessary for the performance of the contract we have entered into with you or your company,
• Being necessary for the fulfillment of our legal obligations,
• Your Personal Data being made public by you,
• Being necessary for the use or protection of our legal or contractual rights as the Digital Transformation and Sustainability Association,
• Being necessary for our legitimate interests in processing your Personal Data, provided that it does not harm your fundamental rights and freedoms.

As the Digital Transformation and Sustainability Association, we retain all Personal Data we process in accordance with KVKK and other applicable legislation, and we take all necessary administrative and technical measures to protect them, ensuring that the above legitimate purposes remain intact.

c. For What Purposes Do We Process Your Personal Data?

We process the Personal Data we collect for the following general purposes based on their nature:

1. Fulfilling the obligations of the contracts entered into by the Digital Transformation and Sustainability Association, supplying, producing, selling, delivering, and installing the offered products and services, developing these products and services, conducting necessary work and evaluations to benefit you from them, and performing after-sales maintenance and repair operations.
2. Monitoring and fulfilling obligations arising from consumer legislation and responding to consumer inquiries.
3. Tracking, evaluating, and providing support services for the requests and complaints of relevant individuals such as customers and consumers, managing consumer satisfaction, and conducting planning, statistical, and satisfaction surveys within this scope.
4. Conducting quality assessment and improvement studies to provide better and more reliable products and services and ensure sustainability, and supervising the suppliers, subcontractors, and individuals we have business relationships with.
5. Conducting advertising and marketing activities for the products and services offered by the Digital Transformation and Sustainability Association to promote them, running promotions, campaigns, offers, events, and similar activities, informing about new products and services, and conducting corporate communication activities.
6. Conducting marketing and CRM (Customer Relationship Management) activities.
7. Organizing corporate communication and other events and invitations within this scope, and conducting market research studies.
8. Improving the digital platforms we offer to our customers, consumers, and business connections, and providing efficient and personalized experiences to platform users by analyzing statistics such as the number, type, frequency of visits, behaviors, geographical locations, and similar data of users, offering personalized content, campaigns, and advertisements based on the interests and needs of platform (internet and mobile site and applications) users, and using cookies for this purpose.
9. Ensuring the legal and commercial security of individuals within the business relationship with the Digital Transformation and Sustainability Association (planning administrative operations related to communication conducted by our company, ensuring and supervising the physical security and inspection of our company’s locations, evaluation and inspection processes of business partners/customers/suppliers (authorized or employees), legal compliance processes, etc.).
10. Using legal rights, using information related to transaction history as evidence in case of disputes after the termination of the legal relationship.
11. Determining and implementing the commercial, legal, and business strategies of the Digital Transformation and Sustainability Association.
12. Executing human resources and accounting/finance policies of the Digital Transformation and Sustainability Association.
13. Planning, supervising, and executing information security processes.
14. Ensuring compliance with domestic and international legislation, providing information requested by public institutions and organizations, and fulfilling reporting obligations.

d. Transfer of Personal Data and Processing of Personal Data by Third Parties

The Company may transfer personal data to a third natural or legal person in accordance with KVKK regulations. In this case, the Company ensures that the transferred third parties also comply with this Policy. Necessary protective arrangements are added to the contracts signed with the third party in this context.

• Transfer of personal data to third parties located in Turkey; Personal Data may be transferred by the Company to third parties located in Turkey without requiring explicit consent in exceptional cases specified in Articles 5.2 and 6.3 of KVKK, or with the explicit consent of the Data Subject in other cases (Articles 5.1 and 6.2 of KVKK).
• Transfer of personal data to third parties located abroad; Personal Data may be transferred by the Company to third parties located abroad without requiring explicit consent in exceptional cases specified in Articles 5.2 and 6.3 of KVKK, or with the explicit consent of the Data Subject in other cases (Articles 5.1 and 6.2 of KVKK). However, in terms of the foreign country to which the data is to be transferred, one of the following conditions must be met:
• The foreign country to which personal data is transferred is recognized by the Personal Data Protection Board as a country with adequate protection,
• If the foreign country to which the transfer will occur is not listed on the Board’s list of secure countries, the Company and the Data Controllers in the relevant country must provide a written commitment that adequate protection will be ensured and obtain permission from the Board.

e. Your Rights and Application Procedures

e.1. Your Rights Regarding Your Personal Data

We would like to inform you that you have the following rights regarding your data processed within the Digital Transformation and Sustainability Association and its affiliates:

1. To know whether your Personal Data is being processed;
2. To obtain information about your Personal Data if it is being processed;
3. To know the purpose of processing your Personal Data and whether it is being used appropriately for that purpose;
4. To know who the third parties to whom your Personal Data is transferred are and which data is transferred, if applicable;
5. To request the correction of your Personal Data if it is incomplete or incorrect;
6. To request that the correction, deletion, or destruction of your Personal Data be communicated to the third parties to whom your Personal Data has been transferred;
7. To request the deletion or destruction of your processed Personal Data if the reasons necessitating the processing have ceased or your Personal Data has become outdated;
8. To object to the occurrence of a result against you by analyzing your Personal Data exclusively through automated systems;
9. To claim compensation if you suffer damage due to the unlawful processing of your Personal Data.

e.2. Application

You can submit your requests regarding your Personal Data by filling out the application form linked below:

1. By submitting it to our consultation office at our company address listed in the Data Controller Identification Information section, or by delivering it via a Notary to the same address,
2. By sending it through registered electronic mail.

Your requests directed to the Digital Transformation and Sustainability Association will be resolved free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. If fulfilling your requests incurs a cost, we may charge you only the fees determined by the Personal Data Protection Board.

As a result of the requests directed to the Digital Transformation and Sustainability Association, we may accept the requests or reject them by explaining the reasons, and we may communicate this response to the requester in writing or electronically. If the request is accepted, the Digital Transformation and Sustainability Association is obliged to immediately fulfill the necessary actions.

e.3. Complaint

If the Digital Transformation and Sustainability Association rejects your requests, if you are not satisfied with the response provided by the Digital Transformation and Sustainability Association, or if no response is given, you can file a complaint to the Personal Data Protection Board within thirty (30) days from the date the response was communicated to you or within thirty (30) days from the end of the thirty (30) day period if no response is given.

f. Data Controller Identification Information

The term "Digital Transformation and Sustainability Association" used in this document is established in Turkey and is prepared for the affiliate of the Digital Transformation and Sustainability Association, which is identified below as the data controller for the relevant individuals regarding the data:

Digital Transformation and Sustainability Association

Address: Yenişehir Mah. Osmanlı Bulvarı No:11/A 28 Pendik/Istanbul

Email Address: info@ddsder.org.tr

KVKK Application Form

Under the Personal Data Protection Law No. 6698 (“KVKK”), individuals defined as data subjects (“hereinafter referred to as “Applicant”) are granted certain rights to make requests regarding the processing of their personal data as outlined in Article 11 of the KVKK. According to the Communiqué on the Procedures and Principles of Applications to the Data Controller (Decree dated 10/03/2018 and numbered 30356), applications regarding these rights to our company as the data controller must be submitted personally, in written Turkish, and through the methods specified below by the Personal Data Protection Board (“Board”).

Below are the details on how written applications should be submitted to us.

The following information must be included in written applications:

• Name, surname, and signature if the application is written,
• Turkish citizens' T.C. Identification Number, foreigners' nationality, passport number, or identification number if available,
• Residential or business address for service of process,
• Electronic mail address, phone, and fax number for notification if available,
• Subject of the request

Additionally, information and documents related to the subject must be attached to the application.

If you wish to make an application regarding your personal data, the following application form must be filled out completely. This application form has been prepared to identify your relationship with our company, accurately determine any personal data processed by our company, and provide a correct and legally timely response to your relevant request. To eliminate potential legal risks arising from unlawful and unjustified data sharing and especially to ensure the security of your personal data, our company reserves the right to request additional documents and information (such as a copy of your national ID or driver's license) for identity and authority verification. If the information provided in the form is incorrect, not up-to-date, or if an unauthorized application is made, our company does not accept liability for the requests resulting from such incorrect information or unauthorized applications.

Applications submitted to us will be responded to in writing free of charge within thirty (30) days at the latest, in accordance with the second paragraph of Article 13 of the KVKK, depending on the nature of the request.