The protection of personal data is one of the most important priorities of Nillkin Communication Accessories Import Trade Inc. and utmost efforts are made to comply with the relevant legislation, particularly the Personal Data Protection Law No. 6698 (“Law”). This Personal Data Protection and Processing Policy (“Policy”) explains the fundamental principles adopted by the Company regarding personal data processing activities and provides transparency to personal data subjects by informing them. In this regard, your personal data is processed and protected in accordance with this Policy.
This Policy applies to all personal data processed by the Company, whether fully or partially automated or through non-automated means as part of a data recording system.
PERSONAL DATA PROTECTION MATTERS
1. Ensuring the Security of Personal Data
The Company takes necessary measures to prevent the unlawful disclosure, access, transmission, or other security breaches of personal data, in accordance with Article 12 of the Law. In this scope, technical and administrative measures are taken to ensure the required security level, in line with the guidelines published by the Personal Data Protection Authority (“Authority”), and audits are carried out or outsourced.
2. Protection of Sensitive Personal Data
Special importance is attached to certain personal data that may lead to victimization or discrimination when processed unlawfully. These include race, ethnic origin, political views, philosophical beliefs, religion, sect, or other beliefs, clothing and appearance, membership in associations, foundations or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
The Company takes utmost care in protecting sensitive personal data processed in compliance with the Law, and the necessary technical and administrative measures are strictly applied to protect sensitive personal data within the Company.
3. Raising Awareness and Auditing Regarding the Protection and Processing of Personal Data
To prevent unlawful processing and access to personal data and ensure their preservation, necessary training is provided within the Company to raise awareness.
Actions are taken to raise awareness among employees regarding personal data protection, and consultancy services are obtained when necessary. The Company evaluates participation in related trainings, seminars, and information sessions, and updates its training programs in parallel with changes in the relevant legislation.
4. Conditions for Processing Personal Data
Except for the explicit consent of the personal data subject, personal data processing may be based on one or more of the following conditions. If the processed data is sensitive personal data, additional conditions outlined in the Personal Data Protection Board's Decision No. 2018/10, dated 31/01/2018, will also apply.
The conditions for processing personal data are as follows:
- The explicit consent of the personal data subject
- Clearly foreseen in laws
- Inability to obtain explicit consent due to factual impossibility
- Directly related to the establishment or performance of a contract
- The fulfillment of the Company’s legal obligations
- The personal data subject has made the data public
- Necessary for the establishment or protection of a right
- Necessary for the legitimate interests of the Company
5. Informing the Personal Data Subject
In accordance with Article 10 of the Law and secondary regulations, the Company informs the personal data subjects about the processing of their data, the purposes of processing, who it is shared with, how it is collected, the legal basis, and their rights related to the processing of personal data.
6. Transfer of Personal Data
The Company may transfer personal data and sensitive personal data to third parties (third-party companies, official and private institutions, third parties) in compliance with the purposes of lawful personal data processing, taking the necessary security measures. In this regard, the Company acts in accordance with the provisions of Article 8 of the Law.
7. Storage and Destruction of Personal Data
The Company stores personal data for the period required for the purposes for which it was processed or as specified by the relevant legislation. The Company first determines whether a retention period is specified by the relevant legislation, and if a period is specified, it adheres to this period. If no legal period exists, personal data is stored for as long as necessary for the purpose for which it was processed. After the retention period, personal data is destroyed according to periodic destruction timelines or at the request of the data subject, using appropriate methods (deletion, destruction, or anonymization).
RIGHTS OF PERSONAL DATA SUBJECTS AND EXERCISE OF THESE RIGHTS
1. Rights of the Personal Data Subject and Exercising These Rights
Personal data subjects may communicate their requests regarding their rights through the Application Form on our website, following the procedures determined by the Board.
Personal data subjects have the following rights:
- Learn whether their personal data is processed
- Request information about personal data processing if it has been processed
- Learn the purposes of processing personal data and whether it is used in accordance with those purposes
- Learn the third parties to whom their personal data is transferred
- Request correction of inaccurate or incomplete data and ensure this is communicated to third parties
- Request the deletion or destruction of personal data if the reasons for processing no longer exist, and ensure this is communicated to third parties
- Object to automated decisions that produce results affecting the individual
- Request compensation for damages caused by unlawful processing of personal data
2. The Company’s Response to Applications
The Company takes the necessary administrative and technical measures to address requests made by personal data subjects in accordance with the Law and secondary legislation.
If the personal data subject submits a valid request, the Company will respond as quickly as possible and within 30 (thirty) days at the latest. If the request requires a fee, a charge may be applied in accordance with the tariff set by the Board.
SPECIAL CIRCUMSTANCES IN WHICH PERSONAL DATA IS PROCESSED
1. Camera Surveillance and Recording Activities in the Company and Surroundings
The Company carries out camera surveillance and recording activities within the company and its surroundings for security purposes and in compliance with the applicable regulations and personal data processing conditions outlined in the Law.
In accordance with Article 10 of the Law, personal data subjects are informed about the camera surveillance and recording activities. The areas under surveillance, the number of cameras, and when surveillance is conducted are strictly limited to security purposes and are implemented accordingly.
