INFORMATION TEXT ON THE PROTECTION OF PERSONAL DATA LAW

The information on how the data we collect about you and the services you request will be used and protected is subject to the terms specified in this text during your visit to this website and while benefiting from the services we offer through this site. By visiting this website and requesting to benefit from the services we provide through this site, you accept the terms stated in this "Information Text on the Protection of Personal Data Law and Processing of Personal Data."

A.     INFORMATION/NOTIFICATION ON THE PROTECTION OF PERSONAL DATA LAW AND PROCESSING OF PERSONAL DATA

The purpose of the Law No. 6698 on the Protection of Personal Data is to protect individuals' fundamental rights and freedoms, particularly the privacy of private life, in the processing of personal data, and to regulate the obligations of real and legal persons processing personal data and the procedures and principles they must comply with. Therefore, this text serves to fulfill the disclosure obligation arising from the Law and is presented for the information and examination of visitors regarding "Consent for the Protection of Personal Data and Sharing of Personal Data."

DERİDESEN ETİKET SANAYİ VE TİCARET ANONİM ŞİRKETİ (hereinafter referred to as DERİDESEN) may process your personal data within the framework explained in detail below, in its capacity as the Data Controller under the Law No. 6698 on the Protection of Personal Data (the Law) and relevant legislation.

B.      COLLECTION, PROCESSING, AND PURPOSES OF PROCESSING PERSONAL DATA

Your personal data may vary depending on the products and services or commercial activities offered by DERİDESEN, but it may be processed to ensure that our company provides the best possible products and services.

1.      COLLECTION OF PERSONAL DATA

The personal data you share with our company may be collected verbally, in writing, or electronically through automatic or non-automatic methods, such as offices, branches, call centers, websites, social media platforms, mobile applications, and similar means.

Our company records the visual data of our visitors through a camera surveillance system at building and facility entrances and within the facility. Our company aims to enhance the quality of the services offered, ensure their reliability, maintain the safety of the company, customers, and other individuals, and protect the interests of customers regarding the services they receive within the scope of the camera surveillance activities.

The camera surveillance activities carried out by our company are conducted in compliance with the Law on Private Security Services and relevant legislation. Access to the records recorded and stored in digital environments is limited to a restricted number of company employees. Necessary technical and administrative measures are taken in accordance with Article 12 of the Personal Data Protection Law to ensure the security of personal data obtained as a result of camera surveillance activities.

2.      PROCESSING OF PERSONAL DATA AND PURPOSES OF PROCESSING

The personal data shared by you may be processed for the following purposes:

a) To benefit you and/or the institutions and organizations you represent from the products and services offered by our company, conducting necessary work for determining and implementing our company's commercial and business strategies, performing marketing activities, and carrying out business development and planning activities, but not limited to these.

b) To carry out administrative operations related to communication conducted by our company.

c) To ensure the physical security and control of the locations used by our company.

d) To establish relationships with business partners/customers/suppliers (authorized persons or employees).

e) To fulfill the contractual obligations and financial agreements regarding the products and services offered together with our business partners, suppliers, or other third parties.

f) To implement our company's human resources policies.

g) To follow up on legal affairs.

h) To process your data for the purpose of contacting our company’s call center or using the website.

i) To facilitate participation in training, seminars, or events organized by our company.

j) Your personal data will be stored in electronic and/or physical environments. Necessary business processes and technical security infrastructure developments are implemented to prevent unauthorized access, manipulation, loss, and damage to the personal data obtained and stored by our company.

k) Your personal data will be processed and stored for the duration necessary for the purposes of processing, with all necessary information security measures taken, and will not be used outside the purposes and scope disclosed to you. Upon expiration of this period, your personal data will be removed from our company's data flows through deletion, destruction, or anonymization methods.

l) When personal data is collected, processed, and used on company websites and other systems or applications, relevant individuals are informed about the privacy notice and, if necessary, about cookies. Individuals are informed about our applications on web pages. Personal data will be processed in accordance with the law.

m) The company adopts the principle of complying with the law when sharing data with both business and solution partners. Data is shared only to the extent necessary for the service, with a commitment to data confidentiality from these parties, and they are required to take measures regarding data security.

n) In accordance with the Law on the Regulation of Commerce and the Regulation on Commercial Communication and Electronic Commercial Messages, electronic communications for advertising purposes may only be sent to individuals who have given prior consent. The explicit presence of the person's consent is a condition for sending the advertisement. The company complies with the details of the "consent" as defined in the same legislation. The consent to be obtained should cover all commercial electronic messages sent to the recipients' electronic communication addresses for the purpose of promoting, marketing, or increasing recognition of the company’s goods and services, or for celebratory or well-wishing content. This consent may be obtained in writing on physical media or through any electronic communication means. The important thing is that the recipient’s positive expression of will to accept the sending of commercial electronic messages is accompanied by their name, surname, and electronic communication address.

o) If a contractual relationship has been established with our customers and potential customers, the collected personal data may be used without the customer's consent. However, this usage occurs in accordance with the purpose of the contract. The data is used to better fulfill the contract and the requirements of the service and may be updated by contacting customers if necessary. On the other hand, the data left by potential customers (prospective customers) for us is processed to provide them with easier and higher quality service later. If this data has not turned into a contractual relationship upon their request, it will be deleted.

p) According to the principle of maximum saving or the principle of frugality, the data reaching our company is processed into the system only as much as necessary. Therefore, the data we collect is determined according to the purpose. Unnecessary data is not collected. Other data that reaches our company is similarly transferred to the company’s information systems. Excess information is not recorded in the system, but is deleted or anonymized. This data may be used for statistical purposes. Sensitive personal data, such as health data, is only collected to provide better service to customers and to protect their health and is carefully maintained in the system.

C.      TRANSFER OF PERSONAL DATA

a) The Company may transfer personal data domestically or internationally if the conditions for transferring personal data as outlined in Articles 8 and 9 of the Law and determined by the Personal Data Protection Board are met.

b) The transfer of personal data to third parties within the country may be conducted by the Company, provided that at least one of the data processing conditions specified in Articles 5 and 6 of the Law exists and that the fundamental principles regarding data processing are adhered to.

c) The transfer of personal data to third parties abroad may be conducted if the Company and the data controller in the relevant country provide a written commitment of adequate protection, and with the consent of the Personal Data Protection Board, provided that at least one of the data processing conditions specified in Articles 5 and 6 of the Law exists.

d) If the country to which the data will be transferred is not among the secure countries to be declared by the Personal Data Protection Board, the Company may transfer personal data to third parties abroad, provided that the Company and the data controller in the relevant country provide a written commitment of adequate protection, and with the consent of the Personal Data Protection Board, provided that at least one of the data processing conditions (see Policy Section 3) specified in Articles 5 and 6 of the Law exists.

e) Within the framework of the general principles of the Law, including the data processing conditions in Articles 8 and 9, the Company may carry out data transfers to the parties considered in the table below.

D.     DESTRUCTION OF YOUR PERSONAL DATA

Even if personal data has been processed in accordance with relevant legal provisions, if the reasons for processing it cease to exist, the Company may delete or destroy personal data at its discretion or upon the request of the personal data owner. The deletion or destruction techniques used by us are listed below:

Physical Destruction:

Personal data can be processed in a non-automated manner as part of any data recording system. When such data is deleted/destroyed, a system is implemented for physically destroying the personal data so that it cannot be used later.

Secure Deletion from Software:

When data processed by fully or partially automated means and stored in digital environments is deleted/destroyed, methods for permanently deleting the data from the relevant software are used.

Secure Deletion by an Expert:

In some cases, the COMPANY may engage an expert to delete personal data on its behalf. In this case, personal data is securely deleted/destroyed in a manner that cannot be recovered by a person who is an expert in this area.

Techniques for Anonymizing Personal Data:

Anonymizing personal data refers to making personal data incapable of being associated with a specific or identifiable natural person, even when matched with other data. The COMPANY can anonymize personal data when the reasons for processing such legally processed data cease to exist.

According to Article 28 of the Personal Data Protection Law (KVK Law); anonymized personal data can be processed for purposes such as research, planning, and statistics. Such processing is outside the scope of the KVK Law, and explicit consent from the personal data owner will not be required. Personal data processed in an anonymized manner is outside the scope of the KVK Law. The COMPANY commonly uses the following anonymization techniques:

A-Masking:

Data masking is a method that removes the essential identifying information of personal data from the dataset to make the personal data anonymous.

B-Aggregation: 

The data aggregation method involves aggregating multiple data points, making personal data unidentifiable with any individual.

C-Data Derivation:

With the data derivation method, more general content is created from the content of personal data, rendering it unidentifiable with any individual.

D-Data Shuffling:

The data shuffling method involves mixing the values in the personal data set to sever the link between the values and individuals. (The Company can obtain detailed information on this matter from the IT department it supports.)

E.      CIRCUMSTANCES UNDER WHICH PERSONAL DATA CAN BE PROCESSED WITHOUT EXPLICIT CONSENT ACCORDING TO THE PERSONAL DATA PROTECTION LAW:

According to Article 5 of the KVK Law, your personal data specified below can be processed without requiring your explicit consent in the following cases:

1.     Clearly provided for in laws.
2.     It is necessary to protect the life or bodily integrity of a person who is unable to express their consent due to an actual impossibility or whose consent is not legally recognized.
3.     Personal data of parties related to a contract must be processed directly in connection with the establishment or performance of the contract.
4.     It is mandatory for the data controller to fulfill its legal obligation.
5.     The personal data has been made public by the relevant person.
6.     Processing personal data is mandatory for the establishment, exercise, or protection of a right.
7.     It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

F.       YOUR RIGHTS REGARDING THE PROTECTION OF YOUR PERSONAL DATA

As far as your personal data is processed by DERIDESEN in its capacity as data controller, you can exercise your rights under Article 11 of the Personal Data Protection Law by filling out the "Personal Data Protection Law (KVKK) Application Form" at the end of this document and delivering it in person to the workplace address from which you received services, sending it via notary, emailing it with your secure electronic signature, or by sending a “Word or PDF” file signed with a secure electronic signature to kvkk@deridesen.com.tr, in accordance with the relevant legislation regarding your personal data:

1)      Learn whether it is processed; if processed, request information about it and learn the purpose of processing and whether it is used in accordance with that purpose.

2)      Know the third parties to whom personal data has been transferred, either domestically or internationally,

3)      Request correction if it is incomplete or incorrectly processed.

4)      Request that the relevant third parties be informed of the corrections made to your incomplete or incorrectly processed personal data.

5)      Request the correction of your incomplete or incorrect personal data and that the process carried out in this context be communicated to third parties to whom your personal data has been transferred.

6)      Appeal against adverse consequences that may arise as a result of processing through automated systems.

7)      In case of damage due to unlawful processing of personal data, request compensation for the damage.

If you wish to learn whether personal data is being processed, request information if it is processed, learn the purpose of processing personal data, or know the third parties to whom personal data has been transferred domestically or internationally, the relevant information will be provided to you in writing or electronically through the contact information you provided, in an understandable and clear manner, free of charge, within a maximum of thirty days, depending on the nature of your request. However, if the processing incurs a cost, you may be charged according to the tariff determined by the Personal Data Protection Authority.

The Company first determines whether the person making the request is the actual rights holder during the evaluation of data owner applications. However, the Company may also request detailed and additional information for a better understanding of the request if deemed necessary.

Responses to data owner applications from the Company are provided to the data owners in writing or electronically. If the application is rejected, the reasons for the rejection will be explained to the data owner with justification.

Şirket tarafından veri sahibi başvurularına yanıtlar, yazılı olarak veya elektronik ortamda veri sahiplerine bildirilmektedir. Başvurunun reddedilmesi halinde ret nedenleri gerekçeli olarak veri sahibine açıklanacaktır.

If you apply to us in writing regarding your rights mentioned above, your request will be responded to free of charge within a maximum of 30 (thirty) days, depending on the nature of your request. You must deliver your application, clearly and understandably, with the identification and address documents that verify your identity, to our company's address in person, by mail, or via notary, using the application form available on our website.