GDPR / KVKK Privacy Notice

ELİBOL TAŞIMACILIK TURİZM İNŞ. VE GIDA SAN. TİC. LTD. ŞTİ.
PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. INTRODUCTION

The protection of personal data is one of the highest priorities of Elibol Taşımacılık Turizm İnş. ve Gıda San. Tic. Ltd. Şti. ("Elibol" or "the Company"). Elibol makes every effort to act in compliance with all applicable legislation in this regard. This Policy sets out the principles adopted in carrying out personal data processing activities by our Company and the fundamental principles adopted to ensure compliance with the provisions of Law No. 6698 on the Protection of Personal Data ("the Law" or "KVKK").

1.2. Purpose

This Policy has been prepared to manage the compliance activities to be carried out by Elibol in order to achieve compliance with the KVKK regarding the protection of personal data. In accordance with the principles set out in this Policy, Elibol will make the necessary arrangements for the lawful protection and processing of personal data and will establish the necessary systems to raise awareness among its employees and business partners in this regard.

1.3. Scope

This Policy covers all personal data processed by our Company, whether fully or partially automated or by non-automated means provided they form part of a data recording system, belonging to employees, job applicants, company officials, company shareholders, customers, visitors, employees, shareholders and officials of organisations with which we cooperate, and third parties.

1.4. Implementation and Effectiveness of the Policy

The relevant legal regulations in force regarding the processing and protection of personal data shall take precedence. In the event of any inconsistency between the applicable legislation and this Policy, our Company accepts that the applicable legislation shall prevail. The effective date of this Policy is 28.09.2020.

2. MATTERS CONCERNING THE PROCESSING OF PERSONAL DATA

Our Company carries out personal data processing activities in accordance with Article 20 of the Constitution and Article 4 of the KVKK: lawfully and in good faith; accurately and up to date; for specific, explicit and legitimate purposes; and in a manner that is connected to, limited to, and proportionate with the purpose for which personal data are processed.

3. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH LEGISLATION

3.1. Processing in Accordance with Law and the Rules of Good Faith

Elibol acts in accordance with the principles introduced by legal regulations and the general rules of good faith in the processing of personal data. In this context, personal data are processed to the extent required by our Company's business activities and limited thereto.

3.2. Ensuring Personal Data Are Accurate and Up to Date When Necessary

Elibol ensures that the personal data it processes are accurate and up to date, taking into account the fundamental rights of personal data subjects and its own legitimate interests.

3.3. Processing for Specific, Explicit and Legitimate Purposes

Our Company determines its legitimate and lawful personal data processing purposes clearly and precisely. Personal data are processed only to the extent connected to and necessary for the services it provides.

3.4. Being Connected to, Limited to, and Proportionate with the Purpose

Our Company processes personal data in a manner suitable for achieving the determined purposes and refrains from processing personal data that are not related to or not needed for the realisation of the purpose.

3.5. Retention for the Period Prescribed by Relevant Legislation

Our Company retains personal data only for the period specified in the relevant legislation or for as long as necessary for the purpose for which they are processed. Upon expiry of the retention period or when the reasons for processing cease to exist, personal data are deleted, destroyed or anonymised by our Company.

4. CONDITIONS FOR PROCESSING PERSONAL DATA

As a rule, personal data must be processed based on one or more of the personal data processing conditions set out in Article 5 of the KVKK. The processing conditions other than the explicit consent of the personal data subject are as follows:

• Existence of Explicit Consent of the Personal Data Subject: Consent that is specific to a subject, based on information, and expressed with free will.
• Expressly Provided for by Law: The existence of an explicit provision regarding the processing of personal data in the relevant law.
• Inability to Obtain Consent Due to Actual Impossibility: Where it is mandatory to protect the life or physical integrity of a person.
• Direct Relation to the Establishment or Performance of a Contract: Where it is necessary for the establishment or performance of the contract to which the data subject is a party.
• Fulfilment of the Company's Legal Obligation: Where it is mandatory to fulfil the legal obligations of the data controller.
• Disclosure of Personal Data by the Data Subject: Where processing is limited to the purpose of disclosure made public by the data subject.
• Establishment or Protection of a Right: Where it is mandatory for the establishment, exercise or protection of a right.
• Legitimate Interest of the Company: Where it is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

4.2. Processing of Special Categories of Personal Data

Article 6 of the KVKK designates the following as "special categories" of personal data: data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Our Company processes such data only under the conditions prescribed by law and by taking all necessary administrative and technical measures.

5. INFORMING THE PERSONAL DATA SUBJECT

In accordance with Article 10 of the KVKK, Elibol informs personal data subjects of the following during the collection of personal data:

• The identity of our Company as data controller
• The purposes for which personal data will be processed
• To whom and for what purpose personal data may be transferred
• The method and legal basis for collecting personal data
• The rights held by the personal data subject

6. TRANSFER OF PERSONAL DATA

Even without the explicit consent of the personal data subject, Elibol may transfer personal data to third parties by taking the necessary security measures if one of the following conditions is present:

• Activities relating to the transfer of personal data are expressly provided for by law
• The transfer is directly related to and necessary for the establishment or performance of a contract
• The transfer is mandatory for our Company to fulfil its legal obligation
• Personal data have been made public by the data subject
• The transfer is mandatory for the establishment, exercise or protection of a right
• Transfer of personal data is mandatory for the Company's legitimate interests

6.3. Third Parties to Whom Personal Data Are Transferred

Persons to Whom Data May Be Transferred	Definition	Purpose of Data Transfer
Business Partner	Parties with whom our Company has established a business partnership in the course of its commercial activities	Limited to ensuring the fulfilment of the purposes for which the business partnership was established
Supplier	Parties providing services to Elibol on a contractual basis, in accordance with Elibol's instructions and directives	Limited to ensuring the provision of services necessary for Elibol to carry out its commercial activities
Legally Authorised Public Institutions and Organisations	Public institutions and organisations authorised to obtain information and documents from Elibol pursuant to the provisions of relevant legislation	Limited to the purpose requested by the relevant public institution or organisation within the scope of its legal authority
Legally Authorised Private Law Persons	Private law persons authorised to obtain information and documents from Elibol pursuant to the provisions of relevant legislation	Limited to the purpose requested by the relevant private law person within the scope of its legal authority

7. CATEGORISATION OF PERSONAL DATA PROCESSED

Personal Data Category	Description
Identity Information	Name-surname, national ID number, nationality, place/date of birth, signature, gender, driving licence, passport, etc.
Contact Information	Phone number, address, e-mail address, fax number
Transaction Security Information	Log records, IP information, authentication information
Transaction Information	Survey data, declaration information, shopping information, membership information, cookie records
Family Members and Close Contacts Information	Information about spouse, mother, father, children, and persons to be contacted in emergencies
Physical Space Security Information	Camera records, vehicle information records
Financial Information	Bank account number, IBAN, income information, receivable/payable information
Visual/Audio Information	Photographs, camera and audio recordings
Special Categories of Personal Data	Race, ethnic origin, political opinion, religion, health, sexual life, criminal conviction, biometric and genetic data
Legal Proceedings and Compliance Information	Data within the scope of determining our legal receivables and rights and compliance with legal obligations
Request/Complaint Management Information	Personal data relating to requests or complaints directed to our Company

8. MATTERS CONCERNING THE PROTECTION OF PERSONAL DATA

8.1. Ensuring the Security of Personal Data

In accordance with Article 12 of the KVKK, our Company takes the necessary technical and administrative measures appropriate to the nature of the data to be protected, in order to prevent unlawful disclosure of and access to personal data. In this context, audits are conducted or arranged to ensure the required level of security.

8.2. Protection of Special Categories of Personal Data

Elibol acts with particular care in protecting special categories of personal data that are lawfully processed. The technical and administrative measures taken for the protection of personal data are also applied diligently with respect to special categories of personal data.

8.3. Awareness and Auditing

Elibol ensures that the necessary training is provided to business units to raise awareness aimed at preventing the unlawful processing of personal data. Training is updated and renewed in parallel with updates to the relevant legislation.

9. STORAGE AND DISPOSAL OF PERSONAL DATA

Our Company retains personal data for the period necessary for the purpose for which they are processed and for the minimum periods prescribed by the relevant legal legislation. At the end of the determined retention periods, personal data are disposed of by deletion, destruction or anonymisation, in accordance with periodic disposal periods or upon the application of the data subject.

10. RIGHTS OF PERSONAL DATA SUBJECTS

Personal data subjects have the following rights:

• To learn whether personal data are processed
• To request information if personal data have been processed
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose
• To know the third parties to whom personal data are transferred, whether domestically or abroad
• To request correction of personal data if they are incomplete or incorrectly processed
• To request deletion or destruction of personal data if the reasons necessitating their processing have ceased to exist, even if they were lawfully processed in accordance with the provisions of the Law
• To object to any outcome that arises against the data subject through the analysis of processed data exclusively by automated systems
• To claim compensation for damages in the event of suffering a loss due to unlawful processing of personal data

10.2. Exercise of Rights

10.3. Response to Applications

Our Company will finalise your requests free of charge within a maximum of thirty (30) days. In the event that a fee is stipulated by the Personal Data Protection Board, the fee set out in the tariff determined by the Board will be charged.

10.4. Right to Lodge a Complaint with the PDP Board

In the event that your application is rejected, the response provided is found to be inadequate, or no response is given within the time limit, you may lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date you learn of our Company's response, and in any case within sixty (60) days from the date of application.