Our company regards the protection of personal data as an integral part of the protection of fundamental rights and freedoms. In order to ensure the confidentiality, integrity and security of the personal data we process, in line with the 6698 sayılı Kişisel Verilerin Korunması Kanunu (KVKK), the personal data protection legislation in force in the countries of operation, and the ISO/IEC 27701 and ISO/IEC 27001 standards, our Personal Data Protection and Privacy Policy is;
- To process personal data in compliance with the law and the rules of good faith, fairly and transparently,
- To process personal data for specified, explicit and legitimate purposes, and to adhere to the principle of data processing that is relevant, limited and proportionate to those purposes,
- To ensure that the personal data processed is accurate, up to date and can be updated where necessary,
- To retain personal data only for as long as necessary, and to securely erase, destroy or anonymize it when the statutory retention periods expire or the purpose of processing ceases to exist,
- To implement appropriate technical and administrative measures to protect the confidentiality, integrity and availability of personal data,
- To plan personal data processing activities with privacy principles in mind from the design stage onwards, and to adopt practices that protect privacy by default,
- To identify and assess the privacy risks that may arise from personal data processing activities with a risk-based approach, and to manage them with appropriate controls,
- To ensure that personal data is accessed in line with duties, authorizations and business needs, and to implement the necessary technical and administrative measures against unauthorized access, use, alteration, disclosure, loss and corruption,
- To manage personal data breaches effectively, to make the required notifications within the statutory time limits, and to carry out corrective and improvement actions to prevent the recurrence of similar breaches,
- To ensure that privacy obligations are fulfilled in the transfer of personal data to third parties, in outsourced services and in supplier relationships,
- To ensure that data subjects can exercise the rights they hold under the applicable personal data protection legislation effectively, in a timely manner and transparently, and that their applications are assessed in accordance with the legislation,
- To provide the necessary training in order to raise the awareness of our employees, our business partners and all interested parties who process personal data regarding the protection of personal data, and to spread a culture of privacy,
- To set personal data protection objectives in alignment with our organization’s strategic objectives, to monitor their performance regularly and to improve it continuously,
- To provide the human resources, technology, infrastructure and other resources necessary for the establishment, implementation, maintenance and continual improvement of the Privacy Information Management System,
- To maintain and improve the effectiveness of the Privacy Information Management System, and to preserve and strengthen the trust of our employees, customers, suppliers, business partners and other interested parties in the protection of their personal data,
- To regularly review the suitability, adequacy and effectiveness of this policy and to update it where necessary,
We undertake to act in accordance with the principles and commitments stated above, to ensure their implementation and to improve them continuously.
Deputy General Manager of Technical Affairs
