Personal Data Protection Law

PRIVACY NOTICE ON THE OBTAINING, PROCESSING AND PROTECTION OF PERSONAL DATA;

1- GENERAL EXPLANATION AND DEFINITIONS

This information notice has been prepared in order for FNP BİLİŞİM REKLAM SAN. TİC. LTD. ŞTİ. (hereinafter “FNP”), in its capacity as “data controller”, to fulfil its “obligation to inform” under Article 10 of the Law on the Protection of Personal Data No. 6698 (the Law). The meanings of the following terms in this information notice are the definitions stated in Law No. 6698 and in the Regulations and Communiqués issued under this Law, and are as follows.

Personal data: Any information relating to an identified or identifiable natural person,

Processing of personal data: Any operation performed on personal data, wholly or partly by automatic means or by non-automatic means provided that they form part of a data recording system, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data,

Data subject: The natural person whose personal data is processed,

Explicit consent: Consent relating to a specific matter, based on information and freely given,

Anonymisation: Rendering personal data incapable of being associated, in any manner, with an identified or identifiable natural person, even by matching it with other data,

Data controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for the establishment and management of the data recording system,

Data processor: The natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller,

Data recording system: The recording system in which personal data is structured according to specific criteria and processed,

Contact person: The natural person notified by the data controller at the time of registration in the Registry, for communication with the Authority concerning the obligations, under the Law and the secondary legislation to be issued pursuant to this Law, of legal persons established in Turkey and of the representative of a data controller that is a legal person not established in Turkey,

Personal data retention and destruction policy: The policy on which data controllers rely when determining the maximum period necessary for the purpose for which personal data is processed, and when deleting, destroying and anonymising personal data.

2- INFORMATION ON THE DATA CONTROLLER

In the case of legal persons, the data controller is the legal person itself. The obligations of legal persons established in Turkey as data controller under the Law are fulfilled through the body or person or persons authorised to represent and bind the legal person. The body authorised to represent the legal person may assign one or more persons in relation to the obligations to be fulfilled for the implementation of the Law. This assignment does not remove the liability of the legal person under the provisions of the Law.

FNP, as a limited company established in Turkey and having legal personality, carries on its activities in the province of Istanbul. Information on FNP as data controller is set out below.

The Data Controller’s;

Protection of Personal Data

Information on the Law on the Protection of Personal Data No. 6698 (KVKK)

This page contains informative content on the responsibilities undertaken by our company regarding the "Law on the Protection of Personal Data No. 6698", which entered into force in order to protect privacy and fundamental rights and freedoms, and on the rights you have in your capacity as a user.

As FNP BİLİŞİM REKLAM SAN. ve TİC. LTD. ŞTİ., we wish to inform you that protecting, within the scope of the laws of the Republic of Turkey, the personal data of our valued users who visit the websites of FNP Digital and our other brands and who benefit from the services they provide is one of our highest priorities.

Personal data means any information relating to an identified or identifiable person, such as name, surname, Turkish identity number and contact details. Your personal data may be processed within the framework of the Law on the Protection of Personal Data No. 6698 ("KVKK"), the Electronic Communications Law No. 5809, the regulations of the Information and Communication Technologies Authority and the Personal Data Protection Authority, and other legislative provisions. In accordance with the relevant legislation, our company takes all technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data, to prevent unlawful access to it and to ensure its retention.

Collection and Processing of Personal Data and Purposes of Processing

Pursuant to Article 4 of the KVKK:
Personal data may be processed only in accordance with the procedures and principles provided in this Law and in other laws. The following principles must be complied with in the processing of personal data:

Lawfulness and conformity with the rules of good faith.
Accuracy and, where necessary, being kept up to date.
Being processed for specified, explicit and legitimate purposes.
Being relevant, limited and proportionate to the purposes for which they are processed.
Being retained for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed.

Your personal data may vary depending on the product, service or commercial activity offered by FNP Digital, and may be collected verbally, in writing or electronically, by automatic or non-automatic means, through offices, the website, social media channels, mobile applications and similar means. For as long as you benefit from the products and services of FNP Digital, your personal data may be processed by being created and updated. Your personal data may also be processed when you visit our website or when you attend training sessions, seminars or organisations held by FNP Digital.

To Whom Processed Personal Data May Be Transferred and for What Purpose

Your recorded personal data is shared, to the extent necessary, with third-party companies, institutions and organisations for domain name registration, licence registration, SSL registration and similar services; with the manufacturers of software, depending on the services and licences used in server services; with banks or credit card institutions for payment and collection services; with third-party email sending companies that provide email dispatch services; with companies and institutions that process e-invoice, e-archive and similar electronic documents for invoicing and accounting; with third-party statistics and analysis companies so that user experience can be measured and marketing activities can be carried out; and with the competent legal authorities.

Your collected personal data may be transferred to public institutions and private persons authorised by law, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK, for the purposes of having our departments carry out the work required for you to benefit from the products and services offered by FNP Digital; customising the products and services offered by our company according to your preferences, usage habits and needs and recommending them to you; ensuring the legal and commercial security of FNP Digital and of persons who are in a business relationship with FNP Digital; determining and implementing the commercial and business strategies of FNP Digital; and conducting human resources policies.

Method and Legal Basis for Collecting Personal Data

Your personal data is obtained, in any verbal, written or electronic medium, for the purposes set out above, so that the products and services offered by FNP Digital can be provided within the determined legal framework and so that FNP Digital can fulfil, fully and accurately, its liabilities arising from contract and from the law. Your personal data collected on this legal basis may also be processed and transferred for the purposes specified in items (1) and (2) of this text, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

Rights of the Data Subject Listed in Article 11 of the KVKK

If you, as personal data subjects, submit to FNP Digital your requests relating to your rights by the methods set out below, our company will conclude the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction also requires a cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by FNP Digital.

In this context, personal data subjects have the right;

To learn whether personal data is being processed,
To request information if personal data has been processed,
To learn the purpose of the processing of personal data and whether it is used in accordance with that purpose,
To know the third parties to whom personal data is transferred in Turkey or abroad,
To request the rectification of personal data if it has been processed incompletely or inaccurately, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
To request the erasure or destruction of personal data if the reasons requiring its processing no longer exist, although it has been processed in accordance with Law No. 6698 and the provisions of other relevant laws, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
To object to the occurrence of a result to the person’s detriment by means of the analysis of processed data exclusively through automated systems,
To request compensation for the damage in the event of damage arising from the unlawful processing of personal data.

Pursuant to paragraph 1 of Article 13 of Law No. 6698, you may submit your request concerning the exercise of the rights stated above to FNP Digital in writing or by the other methods determined by the Personal Data Protection Board. As the Personal Data Protection Board has not determined any method at this stage, you must submit your application to FNP Digital in writing, as required by Law No. 6698.

3- OBLIGATIONS OF THE DATA CONTROLLER

FNP is obliged, within the scope of its obligation to inform data subjects, to inform data subjects of;

The identity of the data controller and, if any, of its representative,
The purpose for which personal data will be processed,
To whom the processed personal data may be transferred and for what purpose,
The method of collecting personal data and its legal basis,
What the rights of persons whose personal data is processed are. FNP also, in relation to data security, takes the necessary security measures in order;
To prevent the unlawful processing of personal data,
To prevent unlawful access to personal data,
And to ensure the retention of personal data. FNP, by carrying out within its own institution or organisation the audits necessary to ensure the implementation of the provisions of Law No. 6698, does not disclose to others, contrary to the provisions of Law No. 6698, the personal data it obtains, and does not use it for purposes other than the purpose of processing.

4- PERSONAL DATA TO BE PROCESSED

FNP will process the personal data set out below, and new items may be added to this information and/or changes may be made where required by the laws and/or where needed.

Personal data subject to processing;

Identity information such as name, surname, Turkish ID number, date of birth and similar,
Contact information such as address, telephone, fax, e-mail and similar,
Tax office and tax number information,
Information on the wages, social security and bank account numbers of its employees, and on family members,
Information on occupation and education,
Information such as camera recordings, fingerprints and similar

5- METHODS OF OBTAINING PERSONAL DATA

Personal data may be obtained directly from the data subject, and may also be obtained indirectly, according to the purpose for which the data is obtained, through online sales platforms, camera recordings, dealers and solution-partner institutions and organisations, without being limited to these.

6- PURPOSE OF PROCESSING PERSONAL DATA

FNP processes personal data for the following purposes. These purposes are;
Fulfilment of obligations regarding public receivables, such as taxes, within the scope of the tax laws, the Turkish Commercial Code No. 6102 and other legal regulations,
Taking of measures relating to the protection of consumer rights within the scope of the Law on the Protection of the Consumer No. 6502,
Receiving orders for the products that data subjects wish to purchase from FNP, sale of the products, delivery of the products to the data subjects, collection of the prices, provision of after-sales services relating to the product sold, measurement of customer satisfaction, and collection and evaluation of any complaints and suggestions relating to the product or service sold,
Improvement of service quality,
Carrying out campaign, promotion, advertising and publicity activities relating to products and services, and providing information on these matters,
Ensuring security within the company and increasing production efficiency,
Proving the employment relationship, recording wage and wage-related information, making statutory notifications to the Ministry of Treasury and Finance, the Social Security Institution and other institutions, applying occupational health and safety principles, fulfilling obligations arising from the laws, and determining working conditions.

7- TRANSFER AND PROTECTION OF PERSONAL DATA

FNP does not transfer the personal data it has obtained in line with its data-processing purposes to third persons or institutions without the explicit consent of the data subject.

FNP may transfer personal data to the persons, institutions and/or organisations that the tax and social security laws and the provisions of other laws and other legislation require or permit, including, without limitation, public legal entities authorised to receive personal data, such as the Revenue Administration, İŞKUR, the Social Security Institution, the Financial Crimes Investigation Board, the Interbank Card Center and the Credit Bureau, and to FNP’s domestic affiliates, to companies operating as dealers, to programme-partner and solution-partner institutions and organisations with which it cooperates, to PTT branches, to companies from which logistics support, consultancy and independent audit services are obtained and, where there is a legal obligation and also where there is no legal obligation, to third persons and institutions in order to achieve its purposes of providing a better service within the scope of Article 6, provided that the rights of the data subject under Law No. 6698 are reserved.

8- OBTAINING THE EXPLICIT CONSENT OF THE DATA SUBJECT FOR THE PROCESSING OF PERSONAL DATA

FNP processes personal data within the scope of Law No. 6698 by obtaining the “explicit consent” of the data subject. Explicit consent means consent relating to a specific matter, based on information, and freely given by the data subject. Pursuant to Article 5/2 of Law No. 6698, where one of the following conditions exists, personal data may be processed without seeking the explicit consent of the data subject.

It is expressly provided for by the laws.
It is necessary for the protection of life or physical integrity of the person himself or herself, or of another person, where the person concerned is unable to express consent owing to actual impossibility, or where consent is not legally valid.
Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
It is necessary for the data controller to fulfil its legal obligation.
The data has been made public by the data subject.
Data processing is necessary for the establishment, exercise or protection of a right.
Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

9- RETENTION PERIOD OF PERSONAL DATA

FNP, destroys personal data when the purpose of processing ceases to exist and when the mandatory retention periods specified under the Laws and other legislation expire (it deletes, destroys or anonymises the personal data).

10- RIGHTS OF THE DATA SUBJECT

Data subjects have the right, by applying to the data controller, with regard to themselves;

To learn whether personal data is being processed,
To request information if personal data has been processed,
To learn the purpose of the processing of personal data and whether it is used in accordance with that purpose,
To know the third parties to whom personal data is transferred in Turkey or abroad,
To request the rectification of personal data if it has been processed incompletely or inaccurately,
To request the erasure or destruction of personal data within the framework of the conditions provided for in the Law,
To request notification to third parties to whom personal data has been transferred of changes relating to personal data,
To object to the occurrence of a result to the person’s detriment by means of the analysis of processed data exclusively through automated systems,
To request compensation for the damage in the event of damage arising from the unlawful processing of personal data.

11- APPLICATION TO THE DATA CONTROLLER

Natural persons whose personal data is processed may, regarding their requests within the scope of the rights specified in Article 11 of Law No. 6698, apply to FNP. Data subjects may exercise this right provided that they make their applications in Turkish. Data subjects may submit their requests, through one of the following communication channels, to FNP. Accordingly, data subjects shall submit their requests;

In writing,
Via a registered electronic mail (KEP) address,
By secure electronic signature or mobile signature, by using the electronic mail address previously notified to FNP by the person whose personal data is processed and registered in the system of FNP,
Applications must include;
Name and surname and, if the application is in writing, a signature,
For citizens of the Republic of Turkey, the T.R. identity number; for foreigners, nationality, passport number or, if any, identity number,
Place of residence or workplace address for the service of notices,
If any, the electronic mail address, telephone and fax number for notification,
The subject of the request,

Information and documents relating to the subject must be attached to the application. Requests may be submitted by using the “Application Request Form”. For applications by data subjects, the communication channels specified in the section of this information notice headed “2- INFORMATION ON THE DATA CONTROLLER” may be used.

FNP concludes the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction also requires a cost, a fee in the amount specified in Article 7 of the “Communiqué on the Procedures and Principles of Application to the Data Controller” may be charged. If the application arises from the fault of the data controller, the fee charged is refunded to the data subject.

12- CHANGES AND UPDATES

This information notice has been prepared within the scope of Law No. 6698 and the Regulations and Communiqués published under that Law, and within the scope of the personal data processing purposes and policies of FNP. Necessary changes may be made to the information notice in line with changes in the relevant legislation and/or in the personal data processing purposes and policies of FNP.

Information Notice The most recent version can be accessed on the website www.fnpdigital.com.tr.

Trade Name	FNP BİLİŞİM REKLAM SAN. TİC. LTD. ŞTİ.
Address	Mimar Sinan Mh. Mimar Sinan Cd. No:5-1 D:15 Kat:4 Çekmeköy - İSTANBUL
MERSIS Number
Tax Office	SARIGAZİ
Tax Number	3880816763
Telephone	0 541 247 06 12
Website	www.fnpdigital.com.tr
E-mail Address	info@fnpdigital.com.tr
Contact Person	Erhan Zerener