Personal Data Protection Law

To protect the fundamental rights and freedoms of individuals, especially the privacy of personal life, and to determine the obligations of natural and legal persons processing personal data, we would like to inform you in accordance with Article 10 of the Personal Data Protection Law (“KVKK”), published in the Official Gazette dated April 7, 2016, and numbered 29677, as the Free Zone Founders and Operators Association (“SEBKİDER”) in the capacity of Data Controller.

1. Purpose of Processing Personal Data

SEBKİDER also serves as the data controller within the scope of Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the “KVKK”). Personal data owners, on the other hand, are individuals whose personal data is collected, processed, and transferred in accordance with the provisions of Law No. 6585 on the Regulation of Retail Trade, Law No. 6698 on the Protection of Personal Data, and other relevant legislation to which SEBKİDER is subject.

We, as SEBKİDER, show maximum sensitivity to the security of personal data. With this awareness, we process and store personal data in accordance with Law No. 6698 on the Protection of Personal Data, the Regulation on Deletion, Destruction, or Anonymization of Personal Data published in the Official Gazette dated October 28, 2017, which constitutes the secondary regulations of the Law, the Regulation on Data Controllers’ Registry published in the Official Gazette dated January 1, 2018, and other relevant regulations.

2. The purpose and scope of the Policy for the Protection and Disposal of Personal Data

• The policy aims to ensure that the regulations introduced within SEBKİDER in accordance with the fundamental principles outlined for compliance with the KVKK (Law No. 6698 on the Protection of Personal Data) are effectively implemented by SEBKİDER itself, its shareholders, authorities, employees, and business partners.
• In accordance with the fundamental regulations envisaged by the policy, SEBKİDER will take all necessary administrative and technical measures for the processing and protection of personal data within its operations, establish the required internal procedures, conduct all necessary training to raise awareness, and establish appropriate and effective audit mechanisms by taking all necessary measures for SEBKİDER shareholders, authorities, employees, and business partners to comply with KVKK processes.
• The policy regulates the obligations of SEBKİDER in directing internal operations in accordance with the fundamental principles to be observed in all these processes and the regulations introduced by the KVKK Law. We will regulate compliance activities that SEBKİDER will carry out regarding the protection of personal data with internal procedures to be established within the framework of the KVKK Law and related legislation. SEBKİDER will be obliged to act in compliance with the provisions of this Policy, the KVKK Law, and all other relevant legislation while performing their duties for all employees.
• In case of non-compliance with the Policy and relevant legal provisions, sanctions will be applied within SEBKİDER in accordance with the nature of the incident, which may include termination of the contract based on justifiable reasons within the framework of the legislation regulating business life, in addition to the legal and penal responsibilities stipulated by the legislation.

The general principles regarding the processing of personal data are as follows:

1. Compliance with the law and honesty: SEBKİDER, as the data controller, will conduct its personal data processing activities in compliance with all applicable laws and regulations, including the Constitution and the Personal Data Protection Law (KVKK), and in accordance with the principle of honesty as stipulated in the Civil Code.
2. Accuracy and currency: SEBKİDER will take all necessary measures within the scope of technical capabilities to ensure the accuracy and currency of personal data processed. SEBKİDER will establish administrative and technical mechanisms to correct and verify inaccurate or outdated personal data based on requests from the data subject or situations deemed necessary by SEBKİDER.
3. Processing for specific, clear, and legitimate purposes: Personal data processed by SEBKİDER will be processed within the scope of services provided or to be provided, in compliance with the law, and for clear and legitimate purposes determined before the processing of the data begins.
4. Processing in connection with the purpose, limited, and measured: SEBKİDER will process personal data in connection with the purpose of processing and to the extent necessary to achieve that purpose. Within this scope, SEBKİDER will avoid processing personal data that is not related to the processing purpose and not necessary.
5. Processing for a limited period as required by legislation or the purpose of processing: Personal data will be retained by SEBKİDER for the period specified by legislation or as required by the purpose of processing. After the expiration of the specified period or the purpose of processing, personal data will be deleted, destroyed, or anonymized by SEBKİDER. SEBKİDER will take necessary administrative and technical measures to prevent the retention of personal data beyond the required period.

These principles will guide SEBKİDER in its processing of personal data in accordance with Article 4 of the Personal Data Protection Law (KVKK).

Individuals whose personal data is processed, whether they are natural persons or legal entities, and in the case of legal entities, their representatives, can exercise the following rights by applying to SEBKİDER in accordance with the provisions of the Law on the Protection of Personal Data (KVKK):

1. To learn whether personal data is being processed,
2. If personal data has been processed, to request information regarding this,
3. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data is transferred domestically or abroad,
5. If personal data is incomplete or incorrectly processed, to request their correction,
6. To request the deletion or destruction of personal data,
7. If personal data is corrected, deleted, or destroyed, to request that these processes be notified to third parties to whom the personal data has been transferred,
8. To object to the occurrence of a result against the individual as a result of personal data being analyzed solely through automated systems,
9. To demand compensation for damages in case of suffering damage due to the unlawful processing of personal data.

Data subjects can submit their requests regarding their rights listed under this section to SEBKİDER free of charge by filling out and signing the Application Form provided on the page with information and documents identifying their identity through the following methods or other methods determined by the Personal Data Protection Board:

(a) By sending an e-mail to the email address info@sebkider.org.tr

(b) By sending the Application Form to the address Beştepe Mah. Nergiz Sokak Via Flat İş Merkezi Kat:3 No:7/2 K. No:87 Yenimahalle/Ankara via registered mail, through a notary, or by hand delivery.

For third parties to make a request on behalf of the data subject, a special power of attorney issued by the data subject through a notary must be present.

If you submit your request to SEBKİDER in accordance with the procedure described in this section, depending on the nature of the request, we will conclude the relevant request free of charge within thirty days at the latest. However, if a fee is prescribed by the Personal Data Protection Board, SEBKİDER will charge the fee specified by the Board from the applicant.

SEBKİDER may request information from you to determine whether the person applying is the data subject and may ask you questions regarding your application to clarify the matters involved.