PDPL Policy

INTRODUCTION, SCOPE, AND DEFINITIONS

APPLICABLE PRINCIPLES

To ensure compliance with the Personal Data Protection Law and other secondary regulations, and to maintain this compliance, our company must adopt the following fundamental principles:

• Our company conducts personal data processing activities in accordance with the legislation on the protection of personal data, primarily the Constitution of the Republic of Turkey, in a lawful and fair manner.
• Our company ensures that the personal data it processes, considering the fundamental rights of the data subjects and its own legitimate interests, is accurate and up-to-date. In this regard, necessary measures are taken.

• Our company clearly and precisely defines the legitimate and lawful purposes for processing personal data. It processes personal data only to the extent necessary and relevant to the commercial activities it conducts.

• Our company processes personal data in a manner conducive to achieving the specified purposes and avoids processing personal data that is unrelated to or unnecessary for the accomplishment of those purposes.
• Our company retains personal data only for the duration specified in relevant legislation or for as long as necessary to fulfill the purposes for which they were processed. In this regard, our company first determines whether there is a legally mandated retention period for personal data. If such a period is specified, we comply with it. If no period is specified, we retain personal data for the duration necessary for the purposes for which they were processed. Upon the expiry of this period or the elimination of the reasons requiring data processing, the personal data are deleted, destroyed, or anonymized by our company.

TERMS

Our company processes personal data in compliance with one or more of the conditions specified in Article 5 of the Personal Data Protection Law (PDPL), except in cases where the relevant individual explicitly consents. If the processed data constitutes sensitive personal data, the conditions outlined in the "Processing and Transfer of Sensitive Personal Data" section of this Policy will be applied.

The explicit consent of the data subject should be based on information and given freely regarding a specific matter. In the presence of the following conditions for processing personal data, personal data may be processed without the explicit consent of the data subject.

• If there is a clear provision in the laws regarding the processing of personal data, it can be stated that this data processing condition exists without the need for the explicit consent of the data subject.

• If it is necessary to process the personal data of a person, or another person, to protect their life or physical integrity, and if it is impossible to obtain consent due to physical impossibility or the consent cannot be considered valid, the personal data of the data subject may be processed.

• If the processing of personal data is necessary for the establishment or performance of a contract to which the data subject is a party, this requirement may be deemed to have been fulfilled.  

• If processing is necessary for compliance with a legal obligation to which the data controller is subject, the personal data of the data subject may be processed.

• If the data subject has made their personal data public, the relevant personal data may be processed to the extent necessary for the purpose of making it public.

• Personal data of the data subject may be processed if it is necessary for the establishment, exercise, or protection of a right.

Personal data of the data subject may be processed if it is necessary for the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

TRANSFER OF PERSONAL DATA

Our company, in line with legitimate and lawful purposes of personal data processing as outlined in this Policy, takes necessary security measures and establishes confidentiality conditions to process personal data and sensitive personal data of the data subject within the country.  

Sensitive personal data are processed and transferred by our company in accordance with the principles outlined in this Policy and with all necessary administrative and technical measures, including methods determined by the Personal Data Protection Board ("Board"). The processing and transfer occur under the following conditions: 

Our company informs the data subjects in accordance with Article 10 of the Personal Data Protection Law during the collection of personal data. In this context, our company provides information about the identity of its representative, if any, the purposes for which personal data will be processed, to whom and for what purposes the processed personal data may be transferred, the method of collecting personal data, the legal basis for processing, and the rights of the data subject.

Within the framework of the purposes and conditions specified in this Policy, detailed information about the categories of processed personal data and their categories can be accessed from Annex-1 ("Personal Data Categories") of the Policy. Detailed information regarding the purposes of processing such personal data is available in Annex-2 ("Purposes of Personal Data Processing") of the Policy.

Within our company, personal data within the categories specified in Annex-1 ("Personal Data Categories") are processed in accordance with the legitimate and lawful purposes of personal data processing of our company, based on one or more of the personal data processing conditions specified in Article 5 of the Personal Data Protection Law, and limited to the principles specified in Article 4 of the Law on the processing of personal data, as well as all the general principles regulated in the Personal Data Protection Law and all the obligations regulated in the Law. Processing is carried out within the scope of the time limits specified in our Company's Personal Data Retention and Destruction Procedure and the relevant individuals are informed in accordance with Article 10 of the Personal Data Protection Law.

Our company conducts monitoring activities with security cameras in work areas to protect the security of the company and other individuals, aiming to safeguard their interests. Şirketimizin görünen alanlarında asılan ya da diğer şekillerde ziyaretçilerin ve çalışanların erişimine sunulan metinler aracılığıyla söz konusu kişisel veri ilgilileri bu kapsamda aydınlatılmaktadırlar.

PRECAUTIONS

Technical Measures Taken Regarding the Law: Our company, in accordance with Article 12 of the Personal Data Protection Law, takes necessary technical measures to prevent the unlawful processing of personal data, to prevent unlawful access to data, and to ensure the protection of data by providing an appropriate level of security in line with the regulations of the Authority, and carries out necessary studies in this context.

: Certain personal data are given special importance under the Personal Data Protection Law due to the risk of causing victimization or discrimination when processed unlawfully. These data include race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance, membership in associations, foundations or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data. Our company is sensitive to protecting special categories of personal data, which are defined as "special categories" by the Personal Data Protection Law and processed lawfully. In this context, the technical and administrative measures taken by our company to protect personal data are meticulously applied to special categories of personal data, and necessary audits are carried out within our company.

Our company, in accordance with the relevant legal provisions, deletes, destroys, or anonymizes personal data upon the elimination of the reasons requiring their processing, despite having been processed lawfully, or upon the request of the data subject, as per the practices specified in our Personal Data Retention and Destruction Policy. Our company uses one or more techniques from the methods for deleting and anonymizing personal data, as specified in the guide published by the Board on the Deletion, Destruction, or Anonymization of Personal Data, that are most suitable for its business processes and activities, and continues to use them in an anonymized form.

Our company, in accordance with Article 10 of the Personal Data Protection Law, informs the data subject of their rights and guides them on how to exercise these rights. Furthermore, our company implements the necessary channels, internal processes, administrative, and technical arrangements in accordance with Article 13 of the Personal Data Protection Law to evaluate the rights of personal data owners and to provide them with the necessary information.

Personal data owners have the following rights:

To learn whether personal data is being processed,

To request information if personal data has been processed,

To learn the purpose of processing personal data and whether they are being used for their intended purpose,

To know third parties to whom personal data are transferred domestically or abroad,

To request the correction of personal data if it is incomplete or inaccurately processed and to request notification of such correction to third parties to whom the personal data have been transferred,

To request the deletion or destruction of personal data if the reasons requiring their processing have ceased to exist, despite being processed in accordance with the Personal Data Protection Law and other relevant laws, and to request notification of such action to third parties to whom the personal data have been transferred,

To object to a decision made against the individual based solely on the analysis of processed data through automated systems,

To request compensation for damages suffered due to the unlawful processing of personal data.

The data subject can submit their requests regarding the rights listed under this section 9.1 by filling out and signing the application form available on our company's website (www.tansuurunleri.com.tr) with the information and documents necessary to identify themselves, and by submitting it to our company through the designated methods determined by the Board.

Our company takes the necessary administrative and technical measures to process the applications made by the data subject in accordance with the Law and secondary legislation. If the data subject submits their request regarding the rights listed under section 9.1 to our company in accordance with the procedure, our company will conclude the relevant request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process requires additional costs, a fee may be charged in accordance with the tariff determined by the Board.

TAN SU ÜRÜNLERİ SANAYİ TİCARET VE PAZARLAMA LTD.ŞTİ.

Adres: ZAFER MAH. 2355 SK. NO: 13 BUCA/ İZMİR

Mail: info@tansuurunleri.com.tr

Attachment-1 Personal Data Categorization

Attachment-2 Personal Data Processing Purposes