GDPR Information Notice (KVKK Information Text)

I. INFORMATION ABOUT THE LAW

The Law on the Protection of Personal Data No. 6698 (“KVKK”) entered into force on 07.04.2016. KVKK sets forth the procedures and principles regarding the processing of personal data by natural or legal persons who are classified as “data controllers,” who determine the purposes and means of processing personal data, and who are responsible for establishing and managing the data recording system.

Within the scope of KVKK:

• Explicit consent: Consent that is based on being informed about a specific matter and declared with free will.
• Anonymization: Rendering personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching them with other data.
• Data subject: The natural person whose personal data are processed.
• Personal data: Any information relating to an identified or identifiable natural person.
• Processing of personal data: Any operation performed on data, whether wholly or partly by automatic means, or by non-automatic means provided that it is part of a data recording system, such as collection, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, acquisition, making available, classification, or prevention of use.
• Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
• Data recording system: The recording system in which personal data are structured and processed according to specific criteria.
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

KVKK imposes on data controllers the obligation to inform data subjects, whose personal data will be processed, during the collection of personal data.

According to Article 10 of KVKK, data controllers must inform data subjects about:

• The identity of the data controller and its representative, if any,
• The purposes of processing personal data,
• To whom and for what purposes the processed personal data may be transferred,
• The method and legal basis of collecting personal data,
• The other rights listed in Article 11 of KVKK.

Our Policy on the Processing and Protection of Personal Data has been prepared within this purpose and legal responsibility and is presented for the information of users.

II. PURPOSE OF COLLECTION AND PROCESSING OF PERSONAL DATA

Our Company, within the scope of its field of activity, processes personal data for the purposes of promotion and marketing, improving the website and services, providing services to users, making the website more user-friendly, providing customer services, offering personalized experiences, performing personalized advertising and marketing, recording identity, address, and other necessary information to identify the transaction owner under the Law No. 6563 on the Regulation of Electronic Commerce, the Law No. 6502 on the Protection of Consumers, the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette dated 26.08.2015 and numbered 29457, the Regulation on Distance Contracts published in the Official Gazette dated 27.11.2014 and numbered 29188, and other related legislation; arranging all records and documents that will serve as a basis for transactions in the banking and electronic payment sector, either in electronic or paper form; complying with information retention, reporting, and notification obligations required by legislation and other authorities; fulfilling requests of competent authorities; meeting legal obligations; ensuring transaction security; and preventing unlawful activities.

In this context, personal data are processed within the conditions and purposes of personal data processing set out in Articles 5 and 6 of KVKK, based on the following legal grounds:

• Being directly related to the establishment or performance of a contract,
• Being necessary for the data controller to fulfill its legal obligations,
• Being necessary for the establishment, exercise, or protection of a right,
• Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your personal data may be transferred to third parties or organizations for the purposes stated above, including but not limited to: our Company’s e-commerce infrastructure provider, suppliers, cargo companies, other relevant persons and organizations related to the services provided, partner institutions with whom we cooperate, domestic and/or international organizations, and other third parties acting as data processors on behalf of our Company.

Your personal data are collected in audio, electronic, or written form through websites, mobile applications, social media accounts, cookies, call centers, notifications from administrative and judicial authorities, and other communication channels.

III. PRINCIPLES REGARDING THE USE AND SHARING OF PERSONAL DATA

Pursuant to Article 5 of KVKK, personal data cannot be processed without the explicit consent of the data subject. However, it is possible to process personal data without explicit consent in the following cases:

• Where it is explicitly provided for by law,
• Where it is necessary to protect the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or another person,
• Where it is directly related to the establishment or performance of a contract, provided that it is necessary to process the personal data of the parties,
• Where it is necessary for the data controller to fulfill its legal obligations,
• Where it has been made public by the data subject,
• Where it is necessary for the establishment, exercise, or protection of a right,
• Where it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

According to Article 6 of KVKK, personal data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data, are special categories of personal data. Processing such data without explicit consent is prohibited. However, excluding health and sexual life data, other special categories of personal data may be processed without explicit consent where permitted by law. Within this scope, our Company may transfer your personal data under the conditions specified in Articles 5 and 6 of KVKK.

Our Company, as a data controller, informs data subjects/users with this Information Notice before collecting their personal data in accordance with Article 10 of KVKK. If any data processing activity does not meet the conditions stipulated in KVKK, explicit consent is obtained from data subjects, and processing activities are carried out based on such consent.

Your personal data may be shared in line with the principles of KVKK for purposes such as providing content and services like registration, transaction and customer support, detecting or preventing fraudulent or illegal transactions, data security breaches, providing users with personalized and relevant advertising, and guiding decisions regarding products, websites, applications, services, and marketing communications.

Additionally, personal data may be shared in order to comply with legal requirements, perform our contract with users, respond to claims that any content violates the rights of others, or protect anyone’s rights or safety. In response to official requests concerning criminal investigations, suspected illegal activities, or other activities that may expose the company or its users to legal liability, personal data may also be shared with law enforcement, public authorities, or authorized third parties.

According to Article 9 of KVKK, your personal data collected through any of the methods mentioned above may be transferred abroad, provided that they remain within the scope of KVKK and for the purposes of the contract, to service providers abroad (in countries accredited by the Personal Data Protection Board as providing adequate protection).

IV. PROTECTION OF PERSONAL DATA

Within the scope of KVKK, our Company:

• Prevents unlawful processing of personal data,
• Prevents unlawful access to personal data,
• Ensures the preservation of personal data by taking all necessary technical and administrative measures to provide an appropriate level of security.

Our Company takes reasonable technical and administrative measures to ensure the security of personal data against unauthorized access, potential data loss, intentional deletion, or damage. In this context, software and hardware security measures are applied to the processed personal data, training and audits are carried out, and internal authorizations are made in accordance with KVKK principles.

In line with Article 4 of KVKK, our Company has the obligation to keep your personal data accurate and up-to-date. To fulfill obligations arising from applicable legislation, our customers must share accurate and up-to-date data or update them via the website/mobile application.

We will retain your personal data for as long as necessary for company operations and as long as they are relevant to such activities, and as required by our retention purpose and legal obligations. The retention period may vary depending on how long we need the personal data to provide our services, but if the personal data is of a special category, this period is generally shorter. If you provide explicit consent for longer storage, your data will be retained for that period. If we have legal, contractual, or similar obligations to retain your personal data, we may retain them for as long as required to comply with laws, assist investigations, and perform other actions required by legislation. When the circumstances requiring retention no longer exist, your personal data will be securely deleted or anonymized.

V. RIGHTS ARISING FROM THE LAW ON THE PROTECTION OF PERSONAL DATA

Pursuant to Article 11 of KVKK, data subjects (users) have the right to:

• Learn whether their personal data is being processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing personal data and whether they are used for that purpose,
• Know the third parties to whom personal data are transferred domestically or abroad,
• Request correction of personal data if it is incomplete or inaccurate, and request that the action taken be notified to third parties to whom the personal data have been transferred,
• Request deletion or destruction of personal data if the reasons requiring their processing no longer exist, even though they have been processed in accordance with KVKK and other relevant laws, and request that the action taken be notified to third parties to whom the personal data have been transferred,
• Object to a result against themselves arising solely from the analysis of processed data through automated systems,
• Request compensation for damages in case they suffer damage due to unlawful processing of personal data.

If users wish to exercise one or more of the rights listed above, they may apply in writing to our Company at the following address:

Düzce 1.OSB İstiklal OSB 1 Mah. 4.Cad No:5/5/A Merkez / DÜZCE

Alternatively, they may reach us via our registered electronic mail address, using a secure electronic signature, mobile signature, or through Customer Services.

Head Office:
E-mail: info@engeenery.com
Phone: +90 216 250 32 88

Factory:
E-mail: info@engeenery.com
Phone: +90 380 514 68 28