Personal Data Protection Policy
The confidentiality and security of personal data has great importance for BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ. BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ. implements its data protection and processing policy in international standards in accordance with Personal Data Protection Law (PDPL) numbered 6698.
In the scope of PDPL, BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ. shall act as the “data controller” in its operations whereas the instructions and principles specified in Corporate Personal Data Protection Policy (Policy) shall also be applicable to BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ.
1. SECTION ONE: GENERAL INFORMATION
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ. processes personal data within the limits specified by applicable legislation and through following means:
1. Method of Collecting Personal Data:
The processed personal data varies depending on the type and quality of our products and services. We are able to collect personal data automatically or manually by written, verbal or electronic means through our offices, call centers, website, social media accounts, affiliated branches and similar channels.
Your personal data shall be processed as long as you use our products and services whereas personal data shall be updated when necessary for verification purposes. Furthermore, your personal data shall be processed when you physically visit BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ. offices, branches, dealers, stores and headquarters to use our products and services, or correspond via call centers, or visit webpages and/or social and digital media, or participate in various events, seminars, organizations and trainings held by BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ.
2. Purpose and Principles of Processing Personal Data:
Your personal data shall be processed for following purposes:
i. Performing necessary works by our business units to supply and use the provided products and services
ii. Customizing the provided products and services in accordance with your requirements, habits and needs as well as offering such products and services specifically for your side
iii. Providing legal and commercial security for all parties involved in business relations with our side (for instance administrative operations conducted by our side for correspondence, physical security and supervision of all areas belonging to our side, partner/customer/supplier evaluation processes, legal compliance procedures, financial procedures, etc.),
iv. Determining and conducting commercial strategies of our side and implementing human resources policies
v. Further purposes to be notified to your side upon relevant information is received and the conditions and purposes for processing personal data as indicated in Clauses 5 and 6.
The basis of processing personal data shall refer to one of following conditions or relevant personal data processing operation under more than one of stated conditions:
a. Explicit Consent of Personal Data Owner
Explicit consent of data owner is one of essential requirements for processing personal data. Explicit consent of data owner shall be declared by free will and prior notification on a specific issue. The personal data shall be processed for the purposes specified by explicit consent of data owner. In principle, if one of following miscellaneous conditions occurs, then explicit consent of data owner shall not be required.
b. Explicit Stipulation by Laws
If it is stipulated explicitly by laws, the personal data shall be processed in compliance with applicable legislation. In case data processing is permitted by laws, the personal data shall be processed only under relevant reasons and categories specified by stated laws.
c. Failure to Obtain Explicit Consent of Data Owner due to Physical Impossibilities
If personal data processing becomes obligatory to protect life and physical integrity of a person failing to give explicit consent due to physical impossibilities or to have its consent approved, then personal data shall be duly processed.
d. Direct Relation with the Conclusion or Execution of Agreement
Provided that personal data is directly related to conclusion or execution of an agreement, personal data of contracting parties shall be processed when necessary (and provided that personal data to be processed for conclusion and execution of the agreement shall belong to contracting parties).
e. Execution of Legal Obligation
If data processing is deemed obligatory for the execution of legal obligations assigned to BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ, then personal data shall be duly processed.
f. Disclosure of Personal Data by Relevant Owner
If data owner discloses its personal data, then personal data shall be processed under the limits specified for disclosure purposes.
g. Obligatory Data Processing for Establishment or Protection of a Right
In case data processing is necessary to establish, use or protect a certain right, the personal data of relevant owner shall be processed.
h. Obligatory Data Processing for Legitimate Interests
Provided that fundamental rights and liberties of data owner are secured, in case data processing is necessary for legitimate interests of BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ, the personal data shall be processed.
If the processed data refers to exclusive personal data as anticipated in PDP Law and the explicit consent of data owner is not available, then personal data shall be processed under following conditions by taking sufficient measures to be specified by PDP Council:
i. The exclusive personal data excluding healthcare and private life of data owner shall be processed if anticipated by applicable legislation.
ii. If the personal data refers to specific details regarding healthcare and private life of data owner, then such data shall be processed by authorized officials and institutions obliged to maintain confidential information for public health, preventive medicine, medical diagnosis, treatment, patient care, general healthcare services, financial planning and administration purposes.
3. Security of Personal Data
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ takes all necessary measures in accordance with Clause 12 of PDP Law to avoid illegal process or access of personal data and to maintain such data. The Company also avoids illegal processing of personal data by third parties.
4. Transfer of Personal Data
In accordance with data processing terms and purposes indicated in Clauses 8 and 9 of PDPL, your personal data shall be transferred to our shareholders, public institutions authorized by laws, suppliers, business partners, service providers, third parties and/or foreign parties in order to fulfill relevant purposes specified in this Policy.
5. The Rights of Data Owner Indicated in Clause 11 of PDPL
In accordance with Clause 11 of PDPL, you are entitled:
a. To obtain information whether personal data is processed
b. To request further information if personal data is processed
c. To obtain information whether personal data is processed for a specific purpose
d. To obtain information on domestic or international third parties receiving personal data
e. To request for amendment on personal data in case of deficient or incorrect processing
f. To request for notification of third parties receiving personal data in case of an amendment
g. To request for deletion or suppression of personal data in case necessary conditions for data processing are ceased although the personal data is processed in compliance with PDPL and further regulations as well as to notify third parties receiving personal data on the procedures performed in this scope
h. To make objection to an unfavorable consequence by analyzing the requested data via automatic systems
ğ) If personal data is processed in contrary to applicable laws, then you shall be entitled to request for compensation against the damages arising from this condition.
Accurate information/data and regular updates shall be important in exercising relevant rights arising from the data in terms of PDPL and in further regulations whereas your side shall be held responsible against misinformation.
2. SECTION TWO: BASIC PRINCIPLES
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ shall act under following principles to process personal data in compliance with Constitution and PDPL by meeting the terms and conditions indicated in applicable legislation for protecting and processing personal data.
1. Compliance of Personal Data Processing with Applicable Legislation and Good Faith
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ processes personal data in accordance with applicable legislation and good faith by adopting the principle of “transparency” against data owners as specified in Clause 4 of PDPL and by notifying owners of personal data. The transparency and good faith shall be taken as basis for such notification whereas clear information shall be given for the usage of collected data and personal data shall be processed accordingly. It shall be avoided to use personal data to cause an adverse effect on data owner without valid grounds.
2. Accuracy and Update of Personal Data
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ keeps personal data accurate and updated.
3. Processing Personal Data for Specific, Clear and Legitimate Purposes
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ collects and processes personal data with legitimate and valid purposes. BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ also processes personal data in intended manner and limit in accordance with relevant operations.
4. Connection, Limitation and Convenience to Processing Purpose
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ avoids processing irrelevant or unnecessary personal data. In this respect, it is essential to minimize the data processing operation.
5. Maintaining Personal Data for Necessary Period and Purpose Anticipated by Applicable Legislation
BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ maintains the personal data processed in accordance with Clause 138 of Turkish Penal Code, Clause 4 and 7 of PDPL only for the period required to process personal data or anticipated by applicable legislation. In this scope, it is determined whether a period is anticipated for the storage of personal data. If a legal term is specified, then this term shall be followed. If a legal term fails to be specified, then such period shall be determined to fulfill operational purposes and personal data shall be stored throughout the stated term. The personal data shall be deleted or removed if a legal ground requiring to maintain personal data for a further period shall be available.
3. SECTION THREE: VALIDITY AND EXECUTION
This Policy has become valid as of 25.06.2018. In case the entire Policy or certain clauses are updated, the recent updates shall be effective by the release date. Subsequently, the most up-to-date Policy shall be published on www.boyutplastik.com.tr.
IV - DEFINITIONS
Explicit Consent: Refers to the consent declared by free will upon relevant notification on a specific issue.
Anonymization: Refers to the cases in which personal data loses its status inevitably such as deforming a personal data to avoid associating with a natural entity through various techniques like masking, consolidation, data deterioration, etc.
Personal Data Owner: Refers to the natural entity subjected to data processing such as customers, suppliers, visitors, employees and prospective employees.
Personal Data: Refers to all information regarding the identified natural entity. For the above mentioned reasons, processing corporate data is excluded from applicable laws. Personal data includes name-surname, Turkish identity number, e-mail, postal address, date of birth, credit card number, bank account, etc.
Exclusive Personal Data: Refers to private information concerning race, ethnic identity, political view, philosophical belief, religion, sect, faith, appearance, association or union membership status, healthcare, sexual life, conviction, and security measures, biometric and genetic details.
Processing Personal Data: Refers to all procedures regarding personal data such as obtaining, storing, recording, maintaining, amending, disclosing, transferring, receiving, making accessible, classifying or using the data from a semi-automated or entirely automated system.
Data Controller: Refers to the data controller (a natural entity) determining the purposes and means of data processing procedures and managing the data recording system that maintains personal data systematically.
Data Processor: Refers to the natural or legal entity processing personal data in accordance with the consent given by data owner such as (if any) cloud computing firm keeping the relevant data of BOYUT PLASTİK PROFİL VE FOLYO İMALAT SANAYİ LİMİTED ŞİRKETİ or the call-center contractors corresponding in compliance with certain instructions.