Policy On Protection And Processing Of Personal Data

Law No. 6698 on Protection of Personal Data (“Law”) took effect on 7 April 2016 and sets forth regulations on processing of any kind of information on identified or identifiable real persons.

This Elektronik Bilgi Güvenliği A.Ş. Policy on Protection and Processing of Personal Data (“Policy”) sets forth the statements and explanations of Elektronik Bilgi Güvenliği A.Ş. (“E-GÜVEN”) regarding the processing of the personal data of real persons in the categories listed below in accordance with the Law. For this purpose, the field of application of this Policy consists of the processing activities in connection with personal data of the following data subjects:

Actual Customers
Prospective Customers
Shareholders, Authorized Representatives and Employees of Corporate Customers
Company Authorized Representatives
Shareholders
Shareholders, Authorized Representatives and Employees of Business Partners
Shareholders, Authorized Representatives and Employees of Suppliers
Employee Candidates
Visitors
Press Members
Third Parties

This Policy may be revised from time to time for the purpose of adapting to changing conditions and legislation.

1. PRINCIPLES ON PROCESSING OF PERSONAL DATA

Acting in the capacity of data controller, E-GÜVEN complies with the following principles pursuant to Article 4 of the Law:

Compliance with the law and principles of good faith,
Accuracy and up-to-datedness where necessary,
Processing for specific, clear and legitimate purposes,
Relevance, connection and proportionality with the purpose of processing,
Retention for the period required by the applicable legislation or for the purpose of processing.

i. Compliance with the law and principles of good faith

Personal data is processed in accordance with the law and principles of good faith. Accordingly, as Data Controller, E-GÜVEN acts in accordance with the applicable legislation and observes the principles of good faith in the course of processing any kind of personal data.

ii. Accuracy and Up-to-Datedness

Data Controllers must define the processes required for accuracy and up-to-datedness of the personal data processed. Accordingly, E-GÜVEN provides Data Subjects with the opportunity to update their data and takes measures to ensure accurate transfer of the data to databases.

iii. Processing for specific, clear and legitimate purposes

Data Controllers are obliged to keep Data Subjects informed about the purposes of data processing in accordance with their obligation to provide information as stipulated under the Law. Accordingly, acting as Data Controller, E-GÜVEN limits data processing activities to specific and legitimate purposes and provides clear information to Data Subjects through information notices relating to such purposes.

iv. Relevance, connection and proportionality with the purpose of processing

E-GÜVEN performs personal data processing activities only to the extent required for and in connection with the purpose notified to the Data Subject during the collection process.

v. Retention for the period required by the applicable legislation or for the purpose of processing

Data is retained for the period specified under the applicable legislation, if such a period is determined. Where no retention period is specified in the applicable legislation, reasonable retention periods are determined by considering the purpose of data use and company procedures, and data is retained only for such period. Following expiry of these periods, data is deleted, destroyed or anonymized in accordance with company procedures.

2. PURPOSES OF PROCESSING PERSONAL DATA BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

Articles 5 and 6 of the Law stipulate conditions on processing of personal data and special categories of personal data. Special categories of personal data are specified under the Law in a limited manner and consist of data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Article 5 of the Law stipulates the conditions for processing standard personal data, while Article 6 sets forth the conditions for processing special categories of personal data.

Pursuant to the aforementioned articles, standard personal data may be processed where:

The Data Subject gives explicit consent.
Data processing is expressly stipulated by law.
It is necessary for the protection of the life or physical integrity of the person or another person where the Data Subject is unable to provide consent due to actual impossibility or where his/her consent is not legally valid.
It is necessary to process personal data belonging to the parties to an agreement, provided that such processing is directly related to the execution or performance of the agreement.
Data processing is necessary for the Data Controller to fulfil its legal obligations.
Personal data has been made public by the Data Subject.
Data processing is necessary for the establishment, exercise or protection of a right.
Data processing is necessary for the legitimate interests of the Data Controller, provided that the fundamental rights and freedoms of the Data Subject are not infringed.

Special categories of personal data may be processed subject to the following conditions:

The Data Subject gives explicit consent.
Processing of special categories of personal data other than data relating to health and sexual life (data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and appearance, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data) is stipulated by law.
Data relating to health and sexual life may be processed by persons or authorized organizations and institutions subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

Accordingly, E-GÜVEN processes the personal data of real persons in the categories specified in Annex-1 for the following purposes:

The design and/or execution of personalised marketing and/or promotional activities,
The planning and/or execution of market research activities for the sale and/or marketing of products and services,
The planning and execution of event management processes,
The planning and management of application processes for products and/or services,
The planning and/or execution of processes for providing customers with appropriate tools and/or information for the channels they will use to access and/or use products and/or services,
Monitoring contractual processes and/or legal claims,
Monitoring customer inquiries and/or complaints,
The planning and/or execution of operational activities necessary to ensure that the Company’s operations are conducted in accordance with Company procedures and/or applicable legislation,
The execution of strategic planning activities,
The planning and/or execution of supply chain management processes,
The planning and execution of processes relating to the provision of products and/or services,
The planning and/or execution of application, selection and assessment processes for employee candidates,
The creation and/or tracking of visitor records,
The management of relationships with business partners and/or suppliers,
The planning and/or execution of marketing processes for products and/or services,
Ensuring the security of Company operations,
Monitoring financial and/or accounting operations,
Ensuring the security of the Company’s premises and/or facilities,
The establishment and/or management of information technology infrastructure,
The planning and/or execution of customer relationship management processes,
The design and/or execution of advertising and/or promotional and/or marketing activities across digital and/or other platforms,
The planning and/or execution of activities aimed at customer satisfaction and/or experience,
The planning and/or execution of campaign and/or promotional and/or marketing processes,
The planning and/or execution of corporate communications activities,
The planning and/or execution of sales processes for products and/or services,
The planning and execution of renewal processes relating to products and/or services,
Providing information to authorised persons and/or organisations as required under the law,
The planning and/or execution of the Company’s audit and/or ethics activities,
The planning and/or execution of reference and/or intelligence activities for recruitment and/or the Company’s security processes,
The planning and/or execution of operational and/or efficiency processes,
The planning and/or execution of projects in line with our Company’s objectives,
The planning and/or execution of business continuity measures,
The identification and/or assessment of individuals to be targeted in marketing activities in accordance with consumer behaviour criteria,
The planning and/or execution of after-sales support services,
The planning and/or execution of access rights for business partners and/or suppliers,
The planning, auditing and/or implementation of information security processes,
The planning and/or execution of cross-selling activities relating to other products offered by our Company,
The planning and/or execution of business activities.

3. TRANSFER OF PERSONAL DATA BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

i. General Conditions of Transfer

Article 8 of the Law categorizes personal data as standard and special categories of personal data for the purpose of transfers.

Pursuant to the aforementioned Article, standard personal data may be transferred to third parties where one of the processing conditions specified under Section 2 above applies. Accordingly, personal data may be shared by E-GÜVEN with third parties where:

The Data Subject gives explicit consent,
Data processing is expressly stipulated by law,
Data processing is necessary for protecting the life or physical integrity of a person who cannot provide consent due to actual impossibility or whose consent is not considered legally valid,
Data processing is necessary to process personal data belonging to the parties to an agreement, provided that it is directly related to the execution or performance of the agreement,
Data processing is necessary for the Data Controller to fulfil its legal obligations,
Personal data has been made public by the Data Subject,
Data processing is necessary for the establishment, exercise or protection of a right,
Data processing is necessary for the legitimate interests of the Data Controller, provided that the fundamental rights and freedoms of the Data Subject are not infringed.

Article 8 also refers to the processing conditions specified under Section 2 in relation to special categories of personal data, but additionally requires that adequate measures be taken for the transfer. Accordingly, E-GÜVEN may share special categories of personal data with third parties where:

Processing of special categories of personal data other than data relating to health and sexual life (data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and appearance, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data) is stipulated by law, and
Data relating to health and sexual life is processed by persons or authorized organizations and institutions subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

In all cases, such data is shared with third parties only after adequate measures have been taken.

ii. Transfer Abroad

E-GÜVEN may transfer personal data abroad:

Where the Data Subject gives explicit consent, or
Where the Data Subject does not give explicit consent but one or more of the aforementioned conditions are met;

o Provided that there is an adequate level of protection in the country to which the data is transferred, and

o Where there is no adequate protection in the country to which the data is transferred, provided that E-GÜVEN and the Data Controller in the relevant foreign country undertake adequate protection in writing and permission from the Personal Data Protection Board is obtained.

iii. Recipients of Transfer by Elektronik Bilgi Güvenliği A.Ş.

Subject to the conditions above, E-GÜVEN transfers personal data to the following parties:

Suppliers for the purpose of service procurement during outsourced operations of our Company.
Business partners for the purpose of achieving the objectives of the business partnership.
Legally authorized public organizations and legally authorized private persons or organizations, limited to the information requested within the scope of their legal authority.

4. PERSONAL DATA PROCESSED BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

The categorization of personal data processed by E-GÜVEN is provided in Annex-1.

5. PROCEDURE OF PROCESSING PERSONAL DATA BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

As stipulated under the Law, E-GÜVEN provides Data Subjects with information, at the time personal data is obtained, regarding the purposes for which personal data is processed, the recipients and purposes of transferring processed personal data, the methods and legal grounds for collecting personal data and the rights of Data Subjects.

Where any process requires explicit consent under the Law, E-GÜVEN obtains the explicit consent of Data Subjects after providing the aforementioned information.

6. DETERMINATION OF DURATION OF RETAINING PERSONAL DATA BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

E-GÜVEN determines personal data retention periods by considering the applicable legislation and the purposes for which the relevant data is processed. In all cases, E-GÜVEN determines retention periods in accordance with its legal obligations and the relevant limitation periods.

Where the purpose of data processing ceases to exist, data is deleted, destroyed or anonymized unless there is another legal reason or basis requiring retention of the data.

7. RIGHTS OF DATA SUBJECTS AND EXERCISE OF THE RIGHTS

i. Rights of Data Subjects

Pursuant to Article 11 of the Law, Data Subjects have the following rights against the Data Controller:

Get information as to whether the relevant personal data is processed or not.
Request information if personal data is processed.
Get information on the purpose of processing personal data and whether it is used in accordance with the relevant purpose.
Get information on third parties in Türkiye or abroad to whom personal data is transferred.
Request correction if personal data is processed inaccurately or incompletely.
Request deletion or destruction of personal data in accordance with the conditions stipulated in the applicable legislation.
Request notification to third parties to whom personal data has been transferred of the actions taken as a result of requests for correction, deletion and destruction.
Object to an unfavourable outcome resulting from analysis of processed data exclusively through automated systems.
Claim compensation for losses and damages arising from unlawful processing of personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which Data Subjects do not have the right to make a request. Accordingly, the aforementioned rights may not be exercised in relation to data where:

Processing of personal data is necessary for the prevention of a crime or conducting a criminal investigation,
Personal data made public by the Data Subject is processed,
Processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution by competent and authorized public institutions and organizations and professional organizations having public institution status, based on powers granted by law,
Processing of personal data is necessary for protecting the economic and financial interests of the State in relation to budget, tax and financial matters.

Pursuant to Paragraph 1 of Article 28 of the Law, data falls outside the scope of the Law in the following cases, and requests from Data Subjects will therefore not be processed in relation to such data:

Personal data is processed by real persons within the scope of activities relating solely to themselves or family members living in the same household, provided that it is not disclosed to third parties and obligations regarding data security are fulfilled.
Personal data is processed for research, planning and statistical purposes after being anonymized.
Personal data is processed for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defence, national security, public security, public order, economic security, privacy or personal rights and does not constitute a crime.
Personal data is processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law for the purpose of ensuring national defence, national security, public security, public order or economic security.
Personal data is processed by judicial authorities or enforcement authorities within the scope of investigations, prosecutions, trials or enforcement proceedings.

ii. Exercise of the Rights by Data Subjects

Data Subjects may use the “Form for Applications to the Data Controller by the Data Subject” available at [ww.e-guven.com] in order to exercise the aforementioned rights.

Applications shall be submitted together with documents identifying the relevant Data Subject, using one of the following methods:

The completed and signed copy of the form may be delivered by hand, via a notary public or by registered mail with return receipt to [Değirmen sok. Nidakule İş Merkezi No: 18 K:5 Kozyatağı/İstanbul],
The form may be signed with a secure electronic signature pursuant to Electronic Signature Law No. 5070 and sent via registered electronic mail to [elektronikbilgiguvenligi@hs02].kep.tr,
Any other method specified by the Personal Data Protection Board may be used.

E-GÜVEN responds to Data Subjects wishing to exercise the aforementioned rights within the limits stipulated under the Law and within a maximum of thirty days as stipulated under the Law. Where a third party submits an application on behalf of a Data Subject, a special power of attorney issued through a notary public in the name of the person submitting the application must be provided by the Data Subject.

Applications by Data Subjects are generally processed free of charge; however, where a fee tariff is determined by the Personal Data Protection Board, fees may be charged in accordance with such tariff.

E-GÜVEN may request information from the applicant in order to determine whether the applicant is the Data Subject and may ask the Data Subject questions regarding the application in order to clarify the matters specified therein.

8. PROTECTION OF PERSONAL DATA BY ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş.

E-GÜVEN takes reasonable technical and administrative measures to prevent risks of unauthorized access, accidental data loss, intentional deletion or damage to personal data.

Accordingly, E-GÜVEN:

Records access to personal data,
Ensures data security by using software and hardware including antivirus systems and firewalls,
Monitors personal data processing activities on a business-unit basis,
Ensures that the necessary inspections are carried out pursuant to Article 12 of the Law in order to ensure compliance with the provisions of the Law,
Ensures compliance of data processing activities with the Law through internal policies and procedures,
Implements authorisations appropriate to the nature of the data accessed within the Company,
Subjects access to special categories of personal data to stricter measures,
Subjects persons with access to special categories of personal data to additional security checks,
Obtains commitments from external service providers to ensure compliance with the Law where personal data is accessed from outside the Company due to outsourcing or similar reasons,
Takes the necessary steps to inform all employees, particularly those authorized to access personal data, about their duties and responsibilities under the Law.

9. ELEKTRONİK BİLGİ GÜVENLİĞİ A.Ş. INTERNAL GOVERNANCE STRUCTURE FOR PROTECTION OF PERSONAL DATA

A Data Protection Committee (the “Committee”) has been established within E-GÜVEN to monitor and manage the actions required to ensure compliance with the Law. The main duties of this Committee are:

To prepare policies and procedures regarding the protection and processing of personal data within E-GÜVEN and take the necessary actions for their implementation,
To distribute duties within E-GÜVEN for the implementation of policies and procedures and monitor whether the relevant actions are taken,
To monitor audits conducted pursuant to Article 12 of the Law,
To identify actions to be taken within E-GÜVEN to raise awareness regarding the implementation of the Law and allocate the necessary duties relating to such actions,
To ensure that the necessary actions are taken to resolve any questions or issues that may arise in connection with the implementation of the Law and/or policies and procedures,
To take the necessary actions to resolve Data Subject applications where required,
To manage relations with the Personal Data Protection Authority.

Annex-1: Data Categorization
Data Category	Personal Data Categorization Description	Types of Personal Data Included in the Relevant Personal Data Categorization
Identification Details	Information contained in documents such as driving licences, identity cards, residence permits, passports, solicitor’s ID cards and marriage certificates, which clearly belongs to an identified or identifiable person and is included in the data registration system	Turkish National ID number (T.R. ID No.), passport number, ID card serial number, first name and surname, photograph, place of birth, date of birth, age, place of civil registry, certified copy of identification card
Contact Information	Information used to contact the person, which clearly belongs to an identified or identifiable person and is included in the data registration system	Email address, telephone number, mobile phone number, address, etc.
Information on Family Members and Relatives	Information concerning the Data Subject’s family members and relatives, which clearly belongs to an identified or identifiable person, is included in the data registration system and is processed for the purpose of protecting the legal interests of the relevant company and Data Subject	Identification details of the Data Subject’s children and spouse, contact details and professional and educational details, etc.
Customer Information	Information relating to customers using our products and services, which clearly belongs to an identified or identifiable person and is included in the data registration system	Customer number, professional information, etc.
Customer Transaction Details	Information related to any transaction carried out by customers using our products and services, which clearly belongs to an identified or identifiable person and is included in the data registration system	Inquiries and instructions, purchase order and basket details, etc.
Physical Space Security Information	Personal data relating to records made and documents obtained during access to a physical area or while staying in that physical area, which clearly belongs to an identified or identifiable person and is included in the data registration system	Entry-exit logs, visit details, camera records, etc.
Transaction Security Information	Personal data processed for the technical, administrative, legal and commercial security of E-GÜVEN and related parties, which clearly belongs to an identified or identifiable person and is included in the data registration system	Information associated with the Data Subject, matching the person with the action and showing that the person is authorized to perform the action (e.g. website password and passphrase information)
Financial Information	Personal data contained in information, documents and records reflecting any financial consequences arising from the nature of the existing legal relationship with the Data Subject, which clearly belongs to an identified or identifiable person and is included in the data registration system	Information showing the financial consequences of transactions carried out by the Data Subject, credit card debt, loan amount, loan payments, amount and rate of interest, debt balance, balance of receivables, etc.
Marketing Information	Data used by E-GÜVEN in its marketing activities, which clearly belongs to an identified or identifiable person and is included in the data registration system	Reports and evaluations showing the person’s habits and preferences, targeting information, cookie records, data enrichment activities, etc. collected for marketing purposes by E-GÜVEN
Information on Legal Proceedings and Compliance	Personal data processed for the purposes of identifying and pursuing legal claims and rights, and fulfilling obligations and legal requirements, which clearly belongs to an identified or identifiable person and is included in the data registration system	Data contained in documents such as court and administrative authority decisions
Special Categories of Personal Data	Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data, which clearly belongs to an identified or identifiable person and is included in the data registration system	Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and appearance, membership of associations, foundations or trade unions, health and sexual life, criminal convictions and security measures, biometric data and genetic data
Inquiry/Complaint Management Information	Personal data relating to the receipt and assessment of any inquiry or complaint directed to E-GÜVEN, which clearly belongs to an identified or identifiable person and is included in the data registration system	Any inquiries and complaints directed to the Company, and the relevant records and reports
Reputation Management Information	Personal data that may potentially affect the reputation of E-GÜVEN, its shareholders, employees, business partners or customers, which clearly belongs to an identified or identifiable person and is included in the data registration system	Personal data contained in negative news coverage concerning the Company on social media, etc.
Visual and Auditory Information	Visual and auditory records associated with the Data Subject, which clearly belong to an identified or identifiable person and are included in the data registration system	Photographs, camera records and audio records

Annex-2: Definitions
Term	Definition in the Law
Explicit Consent	Consent given freely and based on information regarding a specific matter
Anonymization	The rendering of personal data into a form in which it cannot be linked to an identified or identifiable real person, even when combined with other data
Related Person	A real person whose personal data is processed (referred to as “Data Subject” in the Policy)
Personal Data	Any information relating to an identified or identifiable real person
Processing of Personal Data	Any operation performed on personal data, such as obtaining personal data by fully or partially automated means or by non-automated means provided that they form part of a data registration system, recording, storage, retention, modification, reorganization, disclosure, transfer, acquisition, making available, classification or prevention of the use of data
Data Registration System	A registration system in which personal data is structured and processed according to specific criteria
Data Controller	A real or legal person responsible for determining the purposes and means of processing personal data and for establishing and managing the data registration system