Personal Data Protection Law Privacy Notice

01Data Controller

Under Turkish Personal Data Protection Law No. 6698 (the “Law”), your personal data is collected and processed by Eclit Bilişim Hizmetleri Anonim Şirketi (the “Company”) in its capacity as data controller.

02Personal Data We Collect

Our Company collects your personal data and special categories of personal data (together referred to as “personal data”) in the categories of identity data, contact data, customer data, customer transaction data, transaction security data, contact information such as address, telephone, fax and e-mail, tax office and tax number data, legal-proceedings and compliance data, and marketing and sales data.

03Purposes and Legal Grounds of Processing

Your personal data is processed for the purposes explained below (the “Purposes”) and on the legal grounds set out, within the scope of the personal-data processing conditions specified in Articles 5 and 6 of the Law.

Your collected personal data is processed;

• On the legal ground that it is expressly provided for by law and is mandatory for the data controller to fulfill its legal obligation;
• Fulfilling requests from official authorities,
• Providing information to authorized institutions as required by legislation,
• Ensuring compliance with the retention obligations set out in legislation,
• Responding to data-subject applications in accordance with legislation and carrying out the necessary procedures,
• Reviewing, evaluating and responding to requests received from official authorities or from you,

On the legal ground that processing personal data belonging to the parties to a contract is necessary, provided it is directly related to the establishment or performance of that contract;

• Ensuring that the obligations within the scope of the contractual relationship are duly performed.
• Establishing communication for the purpose of information-technology requirements, systemic structure, the necessity of the IT support services received, and conveying the necessary information to you regarding these services and products,
• Carrying out traffic measurement, statistical analysis, segmentation/profiling and CRM activities for sales and marketing activities,
• Carrying out NPS studies, measuring and increasing customer satisfaction, complaint management, obtaining your opinions and suggestions regarding new services and products, receiving your problem/error reports, and informing you regarding products and services and your complaints and requests,
• Contacting you, identifying products and services that may interest you and making recommendations, sending promotions and gifts, analyzing your online behavior to display personalized advertisements, measuring and improving the quality of the service we provide, and managing our customer portfolio to be profiled and scored according to the segments we determine,
• Using your personal data in every kind of product and service offered/to be offered to you within the scope of the law and relevant legislation governing the business written in our Company’s articles of association, to which your disclosure of personal data to our Company relates, including comparative product and/or service offers, modeling, and existing or new product studies and/or developments,
• For the purpose of determining and implementing our Company’s commercial and business strategies; managing the finance operations, communication, market research and social-responsibility activities, procurement operations (request, quotation, evaluation, order, budgeting, contract), in-house system and application management operations, and legal operations carried out by our Company,

On the legal ground that processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject;

• Event management,
• Carrying out finance and accounting processes,
• Managing emergency processes,
• Performing audit activities, carrying out disciplinary and ethics processes,
• Following up and carrying out legal affairs,
• Carrying out information-technology activities within the scope of planning and executing customer-services processes,
• Ensuring that data is kept accurate and up to date.

Where your explicit consent exists;

• Hosting your identity and contact data on the servers located abroad of the relevant service provider Microsoft Bilgisayar Yazılım Hizmetleri Limited Şirketi for the purpose of using the application.
• Offering you personalized advertisements, campaigns, advantages and benefits for the sales and marketing activities to be carried out to improve the quality of services and products,
• Providing information to authorized institutions as required by legislation — your personal data is processed for these purposes.

04To Whom and for What Purpose Personal Data May Be Transferred

Your collected personal data may be transferred, limited to the Purposes stated above, to our Company’s shareholders, affiliates and business partners, to suppliers from whom services are received within the scope of our legitimate interest, to public institutions legally authorized and to private persons legally authorized within the scope of express provision in the laws and the fulfillment of our legal obligations, to natural or legal persons from whom we receive services or with whom we cooperate in carrying out product/service comparison, analysis, evaluation, advertising and the aforementioned purposes, to program-partner institutions and organizations, to the institutions with which we have agreements for sending the messages we send to our customers, and to the cargo companies that deliver the orders placed to you; in accordance with the rules on the transfer of personal data set out in Article 8 of the Law, within the scope of the data-processing conditions set out in Article 5 of the Law.

05Method of Collecting Your Personal Data

Your personal data is collected both by fully or partially automated means and by non-automated means that form part of a data-recording system; directly by you or by persons authorized to act on your behalf; through our customers, our Company personnel, the institutions to/from which we provide/receive support services, and natural and/or legal persons with whom transactions are carried out under any legislation or contract, and through direct automated systems (our website, our call center, our social-media accounts), in verbal, written or electronic environments;

based on the legal grounds set out in Articles 5 and 6 of the Law, namely;

• Being expressly provided for by law,
• Being mandatory for our Company to fulfill its legal obligation,
• Being directly related to the establishment or performance of a contract and processing being necessary,
• Processing being mandatory for the legitimate interest of our Company, provided that it does not harm your fundamental rights and freedoms,
• Having been made public by you,
• Processing being mandatory for the establishment, exercise or protection of a right,
• The existence of your explicit consent.

06Retention and Destruction Periods

Where a longer period is set out under legislation, or where a period is prescribed under legislation for statutes of limitation, forfeiture periods, retention periods and the like, the periods in the provisions of legislation shall be deemed the maximum retention period.

In accordance with the relevant legislation, the Personal Data Protection Law and its Personal Data Retention and Destruction Policy, Eclit erases, destroys or anonymizes the personal data for which it is responsible in the first periodic destruction process following the date on which the obligation to erase, destroy or anonymize arises.

When the data subject requests the erasure/destruction of their personal data through an application made pursuant to Article 13 of Personal Data Protection Law No. 6698, or where explicit consent is withdrawn pursuant to Article 7(3) of the European Union General Data Protection Regulation (GDPR), which provides that “the data subject shall have the right to withdraw their consent at any time”;

• If all of the conditions for processing personal data have ceased to exist, the personal data subject to the request is erased, destroyed or anonymized using the appropriate destruction method, stating the justification, as soon as possible and within 30 (thirty) days at the latest from the day the request is received.
• If all of the conditions for processing personal data have not ceased to exist, this request may be rejected by explaining the justification pursuant to Article 13(3) of the Law, and the rejection response is notified to the data subject in writing or electronically within thirty days at the latest.

07Your Rights Listed in Article 11 of the Law

We inform you that, pursuant to Article 11 of the Law, you have the following rights in relation to your personal data:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom your personal data is transferred, at home or abroad,
• To request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the transaction carried out within this scope be notified to the third parties to whom your personal data has been transferred,
• To request the erasure or destruction of your personal data where the reasons requiring its processing have ceased to exist, even though it has been processed in accordance with the Law and other relevant legal provisions, and to request that the transaction carried out within this scope be notified to the third parties to whom your personal data has been transferred,
• To object to a result arising against you as a consequence of the analysis of the processed data exclusively through automated systems,
• To request compensation for the damage in the event that you suffer damage due to the unlawful processing of your personal data.

If you submit your requests regarding the above rights to our Company by completing the Data Subject Application Form, which you can access at https://eclit.com/ilgili-kisi-basvuru-formu.pdf, our Company will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by our Company.

Your application must contain;

• Your name, surname and, if the application is in writing, your signature,
• Your Turkish Republic identity number if you are a Turkish citizen, or your nationality, passport number or, if any, identity number if you are a foreigner,
• Your place of residence or business address for notification,
• If any, your electronic-mail address, telephone and fax number for notification,
• The subject of your request,

and, if any, you must also attach the information and documents relating to the subject to your application.

Applications to be made in person or through a notary must be made to our address at Kozyatağı Mah. Sarıkanarya Sok. No:14 ByOffice Giriş Katı, 34742 Kadıköy/İstanbul. For applications made in person, the application must be made with a document proving the identity of the applicant. In the case of an application made by proxy, a notarized power of attorney holding the necessary authorities is required.

Applications to be made by Mobile Signature/Electronic Signature or via e-mail must be sent to the e-mail address kvkk@eclit.com, and applications to be made via a registered electronic-mail (KEP) address must be sent to eclitbilisim@hs01.kep.tr. Depending on the application method, “Information Request within the Scope of the Personal Data Protection Law” must be written on the envelope, on the notification, or in the subject line of the e-mail.

The documents relating to the subject of the application must be attached to the application.

Data subjects may benefit from this right provided that they make their applications in Turkish.

Depending on the nature of your request, you must provide our Company with the information and documents that will enable identity verification, completely and accurately. If the requested information and documents are not duly provided, disruptions may occur in carrying out the investigations to be conducted upon your request in a complete and qualified manner. In this case, our Company declares that it reserves its legal rights. For this reason, you must ensure that your application is sent completely and in a way that includes the requested information and documents, depending on the nature of your request.