Information Notice on the Protection and Processing of Personal Data

I. Method and Legal Basis for Collecting Personal Data

Your personal data may be collected within the scope of membership applications, orders, quotations, sales, shipment, invoicing, payment, communication and support processes through written, verbal or electronic channels such as the website, mobile applications, e-mail, telephone, forms, agreements and similar communication channels.

Your personal data may be processed based on the personal data processing conditions specified in Articles 5 and 6 of the KVKK, particularly within the scope of the establishment or performance of a contract, fulfillment of legal obligations, establishment, exercise or protection of a right, and legitimate interest legal grounds. In cases where explicit consent is required, your explicit consent will be obtained.

II. For What Purposes Is Personal Data Processed?

Your personal data may be processed in accordance with the KVKK and relevant legislation for the following purposes:

• Creating and managing membership records,
• Carrying out quotation, order, sales, shipment and delivery processes,
• Carrying out invoicing, collection, finance and accounting processes,
• Managing customer and member relations and conducting communication activities,
• Receiving and evaluating support requests, complaints and suggestions,
• Carrying out information security processes and managing access records,
• Ensuring backup, preventing data loss and maintaining system security,
• Providing information to authorized institutions and organizations as required by legislation,
• Conducting legal processes and protecting company rights,
• Sending commercial electronic communications and conducting marketing activities if your explicit consent has been obtained.

III. To Whom and For What Purposes May Personal Data Be Transferred?

Your personal data may be transferred to the following persons and organizations, limited to the purposes stated above and in accordance with Articles 8 and 9 of the KVKK:

• Authorized public institutions and organizations,
• Tax offices and relevant financial authorities,
• Banks and payment institutions,
• Logistics and cargo companies,
• Information technology infrastructure providers,
• Persons and organizations from whom legal, audit, financial consultancy and advisory services are received.

Necessary technical and administrative security measures are taken during data transfer.

IV. How Is Personal Data Protected?

Kontrolyum takes the necessary technical and administrative measures to prevent the unlawful processing of personal data, to ensure data security and to preserve personal data.

Within this scope, information security practices such as access authorization, record/log management, firewall systems, backup, penetration tests and similar measures are carried out periodically.

V. Your Rights as a Data Subject under KVKK

As a data subject, you have the following rights under Article 11 of the KVKK:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether the data is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred domestically or abroad,
• To request correction if your personal data has been processed incompletely or incorrectly,
• To request deletion or destruction within the framework of Article 7 of the KVKK,
• To request notification of correction or deletion processes to third parties to whom the data has been transferred,
• To object to any result arising against you through the analysis of your data exclusively by automated systems,
• To request compensation if you suffer damage due to unlawful processing.

VI. How Can You Exercise Your Rights?

Pursuant to Article 13 of the KVKK, you may submit your requests regarding the rights stated above in writing to our company address or through the methods prescribed under KVKK legislation.

Your applications will be concluded as soon as possible and within 30 days at the latest, depending on the nature of the request. If the process requires an additional cost, a fee may be requested according to the tariff determined by the Turkish Personal Data Protection Board.

You can access the Data Subject Application Form here.

For your applications, please contact: info@kontrolyum.com

VII. How Long Is Personal Data Processed?

Your personal data is processed for the period required by the purposes of processing and limited to the retention periods stipulated in the relevant legislation. If the reasons requiring processing cease to exist, your personal data will be deleted, destroyed or anonymized within the scope of Article 7 of the KVKK.

VIII. Processing without Explicit Consent

In accordance with Article 5 of the KVKK, personal data may be processed without explicit consent in cases such as being expressly provided for by law, actual impossibility, legal obligation, making data public, establishment, exercise or protection of a right, and legitimate interest.

IX. Accuracy and Up-to-dateness

It is important that your personal data is kept accurate and up to date. If there is any change in your information, we kindly ask you to update it through the relevant channels.