INTRODUCTION
Gülçiçek Kimya ve Uçanyağlar San. ve Tic. A.Ş. (“GÜLÇİÇEK”), is an organization that adheres to all legal regulations, corporate codes, code of business conduct, and ethical rules. The term "GÜLÇİÇEK" ("we" or "ours/us" or "our") is used in this text to refer to GÜLÇİÇEK and all of its subsidiaries.
GÜLÇİÇEK has a contractual relationship with you as the data controller operating the website you visit. Data belonging to an identified or identifiable real entities are qualified and protected as personal data in accordance with Law on Protection of Personal Data No. 6698 ("LPPD") and the secondary legislation based on it, as well as the decisions of the Personal Data Protection Board ("Board") (hereinafter collectively referred to as "Turkish Data Protection Legislation").
GÜLÇİÇEK is committed to processing, securing, and respecting all personal data relating to real entities, i.e. Individuals, who visit our website or who wish to contact us through our website, in accordance with the Turkish Data Protection Legislation. We present this data privacy statement for your information so that you can understand how we will process individuals' personal data for the purposes of executing agreements and managing customer relations.
LAWFULLY PROCESSING OF YOUR PERSONAL DATA
Personal data of individuals are processed in line with thelegitimate interests (*)of GÜLÇİÇEK because they are directly related to the establishment or performance of the agreement (**) between you and GÜLÇİÇEK due to your use of the website. It is in GÜLÇİÇEK's legitimate interest to manage the performance of the agreement to which GÜLÇİÇEK is a party and to evaluate requests and complaints.
PURPOSE OF PROCESSING PERSONAL DATA
We process personal data for the following purposes:
1) Performance of Customer Satisfaction Activities,
2) Execution of Agreement Processes,
3) Execution of Internal Audit/ Investigation/ Intelligence Activities,
4) Execution/ Supervision of Business Operations,
5) Fulfillment of Legal Notification Obligations.
TYPES OF PERSONAL DATA WE COLLECT
Our Company processes the general personal data of the Individuals consisting of the following personal data types during their visits and applications made on the website www.gulcicek.com.tr for the reasons mentioned above; i) Identity information (Name-Surname), ii) Contact information (Mobile Phone Number, E-mail address), iii) website visit information (IP address, cookies records, permission/consent records, browsing records, log information) and iv) other information that you prefer to provide to us within your message sent to us.
PERSONAL DATA SOURCES
We collect the above-mentioned personal data directly from the Individuals who reach our company by visiting the GÜLÇİÇEK website.
TO WHOM ARE YOUR PERSONAL DATA TRANSFERRED?
In connection with the management of the contractual relationship between us and individuals, we can at any time disclose personal data to a service provider who processes data on our behalf under a service and confidentiality agreement. We do not share the personal data we collect with third parties other than our data processors.
Personal data of individuals are securely processed and stored in local and global data processing systems for financial, contractual, and supplier management purposes, which are used by GÜLÇİÇEK to carry out its operations and transactions effectively.
It is our Company's responsibility to obtain explicit consent from all Individuals whose personal data are processed, in accordance with the Turkish Data Protection Legislation, if necessary, for the processing of their data on GÜLÇİÇEK's domestic data recording systems, and in any case, to inform the Individuals in accordance with the procedures and principles determined under the Communique on Principles and Procedures to be Followed in Fulfillment of the Obligation of Clarification for any data processing activities to be carried out using the GÜLÇİÇEK systems.
HOW LONG WE STORE PERSONAL DATA
We process and retain the personal data of individuals throughout our use of the GÜLÇİÇEK website and as long as the agreement, if any, is in force between you and us. In addition, we continue to store the personal data of individuals for 10 (ten) years after the termination of the agreement between you and GÜLÇİÇEK in accordance with the statute of limitations specified in the Turkish Code of Obligations No. 6098, for our legitimate interests (***). However, within a retention period of 10 (ten) years after the termination of the agreement, we retain personal data in such a way that only certain persons can access it by applying authorization restrictions.
MAINTAINING PERSONAL DATA SECURE
It is our top priority to maintain individuals' personal data secure. Personal data is securely stored either by us or by our carefully selected service providers, who act as data processors under a service and confidentiality agreement. We ensure that strict security measures are in place to keep personal data safe from unauthorized access or disclosure, as well as loss and misuse. We take care that the technical and administrative measures we take in terms of security meet the measures required to be taken in accordance with the Turkish Data Protection Legislation.
DATA PROTECTION RIGHTS OF INDIVIDUALS
Pursuant to Turkish Data Protection Legislation, Individuals may, at any time, apply to GÜLÇİÇEK for any information pertaining to themselves;
a) To learn whether their personal data are processed or not,
b) To demand information as to if their personal data have been processed,
c) To learn the purpose of the processing of their personal data and whether these personal data are used in compliance with the purpose,
d) To know the third parties to whom their personal data are transferred in the country or abroad,
e) To request the rectification of the incomplete or inaccurate data, if any,
f) To request the deletion or destruction of their personal data,
g) To request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom their personal data have been transferred,
h) To object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
i) To claim compensation for the damage arising from the unlawful processing of his/her personal data.
EXERCISE OF RIGHTS REGARDING PERSONAL DATA
Each data subject whose data is processed pursuant to the instructions of the data controller GÜLÇİÇEK has the right to apply to the data controller in accordance with Article 13 of the LPPD to exercise his/her rights set forth in Article 11 of the LPPD. GÜLÇİÇEK, the data controller, is obliged to accept or reject this application within 30 (thirty) days at the latest, provided that it explains its reasoning. However, in order for this application to be considered a proper application, it must meet all of the elements regulated in the Communique on the Procedures and Principles of Application to the Data Controller.
For an application made by any data subject to be recognized as a valid application, it must be made:
• in writing in Turkish language by the data subject himself/herself by presenting his/her identity card; or
• through registered electronic mail (REM) address, secure electronic signature, or mobile signature; or
• by using the e-mail address previously notified to GÜLÇİÇEK by the data subject and recorded in GÜLÇİÇEK's system; or
• by means of a software or application developed by GÜLÇİÇEK for the application purposes
Again, in order for an application to be accepted and considered a proper application, it must contain all of the followings:
• Name, surname, and -if the application is in writing- handwritten signature of the data subject.
• Turkish identity number for citizens of the Republic of Türkiye, nationality for foreigners, passport number or identity number, if any,
• Residential or business address for notifications,
• E-mail address, telephone, and fax number for notifications, if any,
• The subject of the request of the data subject.
Therefore, to exercise the rights granted to data subjects under Article 11 of the PDPL, an application bearing the contact and address information in this Policy and containing all of the elements set out in the Communique on the Procedures and Principles of Application to the Data Controller must be submitted to GÜLÇİÇEK using one of the following methods: registered mail with return receipt requested, in person, via an email address registered in GÜLÇİÇEK's systems, or by electronic mail with a secure electronic signature.
IN THE EVENT OF YOUR INQUIRIES
If you are dissatisfied with our data processing ways, wish to make a complaint, or want to receive information or ask a question on any matter you do not understand, you may contact the Data Protection Officer at any time. (E-mail: kvkk@gulcicek.com.tr)
--- --- ---
(*) Regulated as one of the conditions that make it possible to process personal data without the explicit consent of the data subject pursuant to Personal Data Protection Law No. 6698, Article 5, paragraph 2, subparagraph f).
(**) Regulated as one of the conditions that make it possible to process personal data without the explicit consent of the data subject pursuant to Personal Data Protection Law No. 6698, Article 5, paragraph 2, subparagraph c).
(***) Regulated as one of the conditions that make it possible to process personal data without the explicit consent of the data subject pursuant to Personal Data Protection Law No. 6698, Article 5, paragraph 2, subparagraph f).
