blank

GLOBOTURK TECHNOLOGY AUTOMOTIVE INDUSTRY AND TRADE LLC.

PERSONAL DATA PROTECTION AND PROCESSING POLICY

01.01.2024

 

Contents

  1. INTRODUCTION................................................................................................................................ 2
  2. SCOPE........................................................................................................................... 2
  3. DEFINITIONS....................................................................................................................... 2
  4. PURPOSES OF PROCESSING PERSONAL DATA................................................................... 3
  5. FUNDAMENTAL PRINCIPLES OBSERVED IN THE PROCESSING OF PERSONAL DATA........................ 4

 

  • Principle of Processing Personal Data in Accordance with Law and Rules of Honesty

  • Principle of Ensuring Processed Personal Data is Accurate and Up-to-Date

  • Principle of Processing Personal Data for Specific, Explicit, and Legitimate Purposes

  • Principle of Personal Data Being Relevant, Limited, and Proportionate to the Purpose for Which It is Processed

  • Principle of Retaining Personal Data for the Period Stipulated in Relevant Legislation or Required for the Purpose for Which It is Processed

  1. CONDITIONS FOR PROCESSING PERSONAL DATA.............................................. 5

    • Obtaining Explicit Consent

6.2 Explicit Provision in Laws

  • Factual Impossibility Preventing the Acquisition of Explicit Consent

  • Necessity for the Establishment and Performance of a Contract

  • Necessity for Our Company to Fulfill Its Legal Obligations

  • Personal Data Made Public by the Data Subject

  • Necessity of Processing Personal Data for the Establishment, Exercise, or Protection of a Right

  • Necessity of Processing Personal Data for the Legitimate Interests of Our Company

  1. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA................. 6

    • Processing of special categories of personal data other than health and sexual life

    • Processing of special categories of personal data concerning health and sexual life

  2. TRANSFER OF PERSONAL DATA.............................................................................. 6

    • Domestic Transfer of Personal Data

    • International Transfer of Personal Data

    • Parties to Whom Personal Data May Be Transferred by GLOBOTURK Ltd. Şti.

  3. NOTIFICATION OF DATA SUBJECTS........................................................ 8

  4. RIGHTS OF THE DATA SUBJECT............................................................................ 8

 

 

1.  INTRODUCTION

The processing and protection of personal data are among the highest priorities for our GLOBOWAX brand and GLOBOTURK Teknoloji Otomotiv San. Tic. Ltd. Şti. Our company exercises the utmost care to ensure your data security in full compliance with the law. This GLOBOTURK Teknoloji Otomotiv San. Tic. Ltd. Şti. Personal Data Protection and Processing Policy outlines the core principles adopted for the protection and processing of personal data and ensures that our data processing activities align with the regulations set forth in the Law on the Protection of Personal Data No. 6698 (“the Law”). The purpose of this policy is to ensure transparency by informing individuals whose personal data is or may be processed by our company.

 

 

2.  SCOPE

This Policy applies to natural persons whose personal data is processed by GLOBOTURK Ltd. Şti., whether through fully or partially automated means, or non-automated means provided that the processing is part of a data filing system.

 

 

3.  DEFINITIONS

The definitions of terms used in the GLOBOTURK Ltd. Şti. LPPD Policy and in legislation are provided below.

Law on the Protection of Personal Data No. 6698 (LPPD)

This is the law that determines the obligations of natural and legal persons who process personal data, as well as the procedures and principles they must follow.

Data Subject

Refers to the natural person whose personal data is processed. The data of legal entities are not covered by this law unless they contain information about a natural person.

Personal Data

Personal data refers to any information relating to an identified or identifiable natural person. Data such as a person's name, surname, date and place of birth, phone number, identification number, visual and audio recordings, fingerprints, genetic information, IP address, e-mail address, and hobbies fall within the scope of personal data. For information to be considered personal data, it does not need to be accurate.

Special Categories of Personal Data

These are specific types of personal data enumerated under a numerus clausus principle in Article 6 of the LPPD. Special categories of personal data include data concerning race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance, membership in associations, foundations or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Explicit Consent

Refers to consent that is based on information, related to a specific subject, and declared with free will. A declaration of explicit consent is not subject to any formal requirement.

Data Controller

Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system. The data controller is the person who will answer the questions of “why” and “how” the processing activity will be carried out.

Data Processor

Refers to the natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.

Obligation to Inform

Refers to the obligation of the data controller or their authorized person to inform the data subject about the purpose of data processing, to whom and for what purpose the processed data may be transferred, the method and legal basis of data collection, and other rights listed in Article 11 of the Law.

Personal Data Processing (Storage and Disposal) Policy

 

In accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, this refers to the policy that data controllers use as a basis for determining the maximum period required for the purpose for which personal data is processed, and for the processes of deletion, destruction, and anonymization.

Application Form

This is the document that enables data subjects to learn whether their personal data is being processed, to request information if their personal data has been processed, to learn the purpose of processing their personal data and whether it is used in accordance with its purpose, to know the third parties to whom personal data is transferred domestically or abroad, to request the correction of personal data if it is incomplete or incorrectly processed, to request the deletion or destruction of personal data, to request that operations such as correction, deletion, and destruction be notified to third parties to whom personal data has been transferred, to object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems, and to demand compensation for damages in case of loss due to the unlawful processing of personal data.

Mandatory LPPD Training

Refers to the mandatory training on administrative and technical measures that data controllers and data processors must provide to their own personnel under the LPPD.

 

 

4.  PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed in accordance with the principles and procedures stipulated in the LPPD, with data subjects being informed as per Article 10 of the Law, in line with our Company's personal data processing purposes, based on and limited to at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law.

Your personal data may be processed for purposes such as;

  • To ensure the commercial activities conducted by our company are carried out in accordance with legislation and Company policies, including the necessary work by our business units and partnerships, execution of activities, and planning of business with our partners, authorized dealers, authorized service centers, and suppliers,

  • To plan and implement our company's commercial policies and business strategies,

  • To plan and execute our company's human resources activities and manage personnel recruitment processes,

  • To plan and conduct internship and training programs,

  • To protect our company's commercial reputation and credibility,

  • To conduct internal audit activities,

  • To deliver products for orders placed with our company and through our online sales site, the GLOBOWAX Online Store (otoyikama.tr),

  • To carry out financial, accounting, and fiscal transactions, including invoicing related to sales,

-To fulfill obligations related to after-sales support,

  • To facilitate the use of our company's call center,

  • To address employee and customer requests and resolve complaints,

  • To conduct statistical evaluations for matters such as customer satisfaction, database creation, market research, and analysis,

  • To provide guidance on products that may interest our customers, based on their shopping experiences,

  • To send campaign information, details about new products, and promotional offers to customers and members, should they consent,

 

(Our members can make their choice regarding receiving such information during registration, and can later change this preference in the account information section after logging in, or by using the link in the notification message they receive.)

  • To fulfill our legal obligations and exercise our rights arising from current legislation.

 

 

5.  FUNDAMENTAL PRINCIPLES OBSERVED IN THE PROCESSING OF PERSONAL DATA

5.1.  Principle of Processing Personal Data in Accordance with Law and Rules of Honesty

Our company operates in compliance with legal regulations to ensure that personal data is processed in accordance with the rules of honesty. In this context, data subjects are informed clearly and comprehensibly about which of their data will be used and for what purposes.

5.2.  Principle of Ensuring Processed Personal Data is Accurate and Up-to-Date

Our company takes maximum care to ensure that the personal data processed is accurate and up-to-date. In this context, the necessary technical and administrative measures are taken.

 

 

 

5.3.  Principle of Processing Personal Data for Specific, Explicit, and Legitimate Purposes

Our company processes personal data in connection with its corporate activities and to the extent necessary to carry them out. In this context, data is not processed for purposes other than those communicated to the data subject within the framework of the obligation to inform.

5.4.  Principle of Personal Data Being Relevant, Limited, and Proportionate to the Purpose for Which It is Processed

Our company processes personal data in a limited and proportionate manner in connection with its corporate activities.

5.5.  Principle of Retaining Personal Data for the Period Stipulated in Relevant Legislation or Required for the Purpose for Which It is Processed

In accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the Law on the Protection of Personal Data, our company retains personal data for the period stipulated in the relevant legislation and necessary for the purpose of processing. Accordingly, if there is a period prescribed in the relevant legislation for the storage of data, this period is adhered to; if no legal period is specified, personal data is retained for the time required for the purpose for which it was processed. At the end of the retention periods or when the reasons requiring the processing of personal data cease to exist, the personal data is disposed of.

 

6. CONDITIONS FOR PROCESSING PERSONAL DATA

GLOBOTURK Teknoloji Otomotiv Ltd. Şti. processes personal data within the conditions regulated by legal legislation. The existence of at least one of the following conditions is required for the processing of personal data.

6.1.  Obtaining Explicit Consent

Explicit consent means consent that is based on information, related to a specific subject, and declared with free will. Our company continues its data processing activities with the consent of the data subject, who is informed within the scope of the obligation to inform. Within the scope of the obligation to inform, the data subject is informed about the identity of the data controller and, if any, its representative, the purpose of data processing, to whom and for what purposes the data may be transferred, the method and legal basis of personal data collection, and the rights of the data subject.

6.2.  Explicit Provision in Laws

In cases where it is explicitly stipulated in the laws, personal data may be processed without seeking the explicit consent of the data subject.

6.3.  Factual Impossibility Preventing the Acquisition of Explicit Consent

 

Personal data may be processed without explicit consent if it is necessary for the protection of the life or physical integrity of the person who is unable to express his/her consent due to factual impossibility or whose consent is not legally valid, or of another person.

6.4.  Necessity for the Establishment and Performance of a Contract

Provided that it is directly related to the establishment or performance of a contract, personal data belonging to the parties of the contract may be processed in mandatory cases, limited to the purpose. In this case, it is not necessary to obtain the consent of the data subjects for the processing of personal data.

6.5.  Necessity for Our Company to Fulfill Its Legal Obligations

It may be necessary for our company to process personal data in order to fulfill its legal obligations. In such cases, there is no obligation to obtain explicit consent.

6.6.  Personal Data Made Public by the Data Subject

If personal data is made public by the data subject, there is no need to obtain separate explicit consent for the processing of the data in a manner consistent with the purpose of its disclosure.

6.7.  Necessity of Processing Personal Data for the Establishment, Exercise, or Protection of a Right

In cases where the processing of personal data is necessary for the establishment, exercise, or protection of a right, the condition of obtaining explicit consent for the processing of data is not required.

6.8.  Necessity of Processing Personal Data for the Legitimate Interests of Our Company

If it is necessary for the legitimate interests of our company, it is not necessary to obtain the explicit consent of the data subject for the processing of personal data, provided that it does not harm the fundamental rights and freedoms of the data subject.

 

 

7. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

Special categories of personal data are processed by our company in accordance with the principles for processing personal data, in the presence of a condition of lawfulness, by taking all kinds of administrative and technical measures determined by the Personal Data Protection Board, and under the following conditions:

7.1.  Processing of special categories of personal data other than health and sexual life

In cases stipulated by law, it may be processed without seeking the explicit consent of the data subject and by adhering to other rules such as the fundamental principles and security provisions specified in the Law on the Protection of Personal Data.

7.2.  Processing of special categories of personal data concerning health and sexual life

For the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, it may be processed without seeking the explicit consent of the data subject by persons or authorized institutions and organizations under the obligation of confidentiality. Otherwise, the processing of special categories of personal data is only possible with the explicit consent of the data subject.

 

 

8. TRANSFER OF PERSONAL DATA

Our company may transfer personal data and special categories of personal data obtained lawfully to third parties, provided that necessary measures are taken, within the scope of Articles 8 and 9 of the Law on the Protection of Personal Data and relevant legal legislation.

8.1.  Domestic Transfer of Personal Data

For the domestic transfer of personal data, processing can be carried out in accordance with Article 8 of the Law on the Protection of Personal Data and the conditions for processing personal data regulated in Articles 5 and 6 of the Law as mentioned in this policy, and by taking all necessary measures to ensure data security.

8.2.  International Transfer of Personal Data

For the international transfer of personal data, processing can be carried out in accordance with Article 9 of the Law on the Protection of Personal Data and the conditions for processing personal data regulated in Articles 5 and 6 of the Law as mentioned in this policy, and by taking all necessary measures to ensure data security.

The Personal Data Protection Board has made a distinction between countries with adequate protection for personal data and countries without adequate protection for personal data.

In the presence of explicit consent, personal data can be transferred to both countries with adequate protection and countries without adequate protection. In the presence of the conditions specified in LPPD Art. 5/2 and LPPD Art. 6/3, for personal data to be transferred, the country to which the personal data will be transferred must provide adequate protection for personal data. The transfer of personal data to a country that does not provide adequate protection, in the presence of the conditions specified in LPPD Art. 5/2 and LPPD Art. 6/3, is only possible if the data controllers in Turkey and the relevant foreign country commit to adequate protection in writing and with the permission of the Personal Data Protection Board.

8.3.  Parties to Whom Personal Data May Be Transferred by GLOBOTURK Ltd. Şti.

Your collected personal data may be transferred, in accordance with the personal data processing conditions specified in Articles 8 and 9 of the LPPD and limited to the realization of the purposes stated in this policy, to;

  • The company's shareholders and affiliates

  • The company's business partners,

  • The company's suppliers,

  • Persons or organizations permitted by the provisions of the Turkish Commercial Code, the Turkish Code of Obligations, and other legislation,

  • Legally authorized public institutions and organizations,

  • Real or legal persons from whom our company receives services and cooperates in product/service comparison, analysis, evaluation, advertising, and the realization of the purposes mentioned above, institutions with which we have agreements for sending campaign and promotional messages to our customers, and cargo companies that deliver orders placed from our online store (otoyikama.tr).

9. NOTIFICATION OF DATA SUBJECTS

In accordance with Article 10 of the LPPD and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, our company informs data subjects during the acquisition of personal data. The information provided in the notification text presented to data subjects includes the following:

  • The title of our Company as the data controller,

  • The purpose for which our company will process the personal data of data subjects,

  • With whom and for what purpose the processed personal data may be shared by our company,

  • The method and legal basis for collecting personal data,

  • The rights of data subjects regarding the processing of their personal data.

10. RIGHTS OF THE DATA SUBJECT

Within the scope of Article 11 of the LPPD, the data subject may apply to our company to:

 

  • Learn whether their personal data is being processed,

 

  • Request information if their personal data has been processed,

  • Learn the purpose of processing their personal data and whether it is used in accordance with its purpose,

  • Know the third parties to whom personal data is transferred domestically or abroad,

  • Request the correction of personal data if it is incomplete or incorrectly processed,

  • Request the deletion or destruction of personal data,

  • Request that operations such as correction, deletion, or destruction be notified to third parties to whom personal data has been transferred,

  • Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

  • Demand compensation for damages in case of loss due to the unlawful processing of personal data.

 

In accordance with Article 13 of the LPPD, requests regarding the exercise of the rights mentioned above can be sent to our e-mail address kvkk@globowax.com.tr with a secure electronic signature, delivered by hand with a wet-signed petition along with identity-verifying documents to our address at Başakşehir 1. Kısım Mah. Kemal Sunal Cad. No:19/D – 412 Atrium İş Merkezi 34488 Başakşehir/İstanbul/Türkiye, or sent via a notary public. The application form can be accessed at globowax.com.tr or otoyikama.tr. Our company will conclude the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged according to the tariff determined by the Board.