PERSONAL DATA PROCESSING AND SECURITY POLICY
1. PURPOSE OF THE POLICY
Mihrimah Sultan Turizm Ltd. Şti. As (“Hafsa Tur”), we collect and process some of your personal data in accordance with the Personal Data Protection Law No. 6698 (“KVK Law”) and relevant legislation in order to provide our services in the best possible way.
This Personal Data Processing and Protection Policy (“Policy”) has been prepared to determine and demonstrate the purposes for which your personal data is processed, to which third parties it is transferred, your rights regarding your personal data and Hafsa Tur’s obligations in terms of processing and protection of personal data.
2. SCOPE OF THE POLICY
This Policy covers our activities regarding the processing of personal data we obtain from the following persons:
• Representatives, attorneys and shareholders of our company and group companies,
• Employees and officials of our business partners,
• Employees and officials of our suppliers,
• Our customers and potential customers,
• Our employee candidates, interns, trainee candidates and the people they reference in their applications,
• Family members of our employees,
• Legally authorized persons,
• Our visitors,
• Other third parties.
3. AUTHORITIES AND RESPONSIBILITIES
Hafsa Tur Employees: Are obliged to comply with this Policy and relevant legislation within the scope of all our business activities.
Our suppliers: They are obliged to comply with this Policy and relevant legislation in all services they provide to Hafsa Tur.
Hafsa Tur Senior Management: It is responsible for ensuring that all our business activities are carried out in accordance with this Policy.
4. DEFINITIONS AND ABBREVIATIONS
The abbreviations in this Policy will be used as equivalent to the definitions stated below:
ABBREVIATIONS DEFINITIONS
| ABBREVIATIONS | DEFINITIONS |
| Hafsa Tur | Mihrimah Sultan Turizm Ltd. Şti. |
| Personal Data | Any information regarding an identified or identifiable natural person. |
| Special Personal Data | Data regarding race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data. |
| Related person | Real persons whose personal data is processed. |
| Processing of Personal Data | Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or using personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system. Any action performed on data, such as blocking. |
| Explicit Consent | Consent regarding a specific issue, based on informed consent and expressed with free will. |
| Anonymization | Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data. |
| KVK Law | Personal Data Protection Law No. 6698, dated 24 March 2016, published in the Official Gazette No. 29677, dated 7 April 2016. (Republic of Turkey) |
| Board | Personal Data Protection Board. |
| Organisation | Personal Data Protection Authority. |
| Policy | Mihrimah Sultan Turizm Ltd.Şti. Personal Data Processing and Security Policy. |
| Data Controller | The person who determines the purposes and means of processing personal data and manages the place where the data is systematically kept. |
| Data Processor | It is a real or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller. |
5. PERSONAL DATA PROCESSED BY HAFSA TUR
As the data controller, Hafsa Tur processes the following personal data within the scope of its current activities, including but not limited to those listed here:
PERSONAL DATA GROUP PERSONAL DATA
| PERSONAL DATA GROUP | KİŞİSEL VERİLER |
| Identity Information | Name, Surname, TR. Information such as Identity Number, photograph, date and place of birth, marital status, driver’s license information, passport number, identity card serial number. |
| Communication information | Email, phone number, mobile phone, social media account information associated with the person. |
| Location Information | Information such as residence address, workplace address. |
| Personal Information | Payroll information, disciplinary investigation, employment entry-exit document records, property declaration information, CV information, performance evaluation reports, SSI entry declarations, company title, tax registry and identification number, chamber registration number, reference information. |
| Legal Transaction Information | Information in correspondence with judicial authorities, information in the case file (enforcement information). |
| Physical Space Security Information | Entry and exit information of our customers and visitors to the campuses, records of CCTV in the campuses. |
| Transaction Security Information | IP address information and access records. |
| Financial Information | Balance sheet information, financial performance information, credit and risk information, asset information, pay slips, IBAN information, payment amount, credit card and debit card information, amount to be refunded information, debt information. |
| Professional Experience Information | Diploma information, courses attended, in-service training information, certificates, transcript information. |
| Marketing Information | Shopping history, survey results, information obtained as a result of campaign work. |
| Audiovisual Records | Audio recording, camera images taken. |
| Philosophical Belief, Religion, Sect and Other Beliefs | Information regarding religious affiliation and philosophical belief. |
| Association Membership | Association membership information included in the CVs of employee or intern candidates. |
| Foundation Membership | Foundation membership information included in the CVs of employee or intern candidates. |
| Health Information | Blood type information, personal health information, information specified in the health report, disability status information. |
| Criminal Conviction and Security Measures | Criminal record, criminal conviction or security measure information included in the criminal record. |
| Family Members Information | Information about the person’s family members, such as the number of children and spouse status. |
| Customer Transaction Information | Invoice, promissory note, check information, membership information, customer request and complaint information, product information purchased and used. |
| Complaint and Request Information | Complaint and request information regarding products and services. |
6. OUR METHODS OF COLLECTING PERSONAL DATA
As Hafsa Tur, we collect your personal data through the following channels:
• Email, SMS, business cards,
• Telephone, Fax,
• CCTV (Closed Circuit Camera Recordings),
• Cookies and similar tracking technologies,
• Physical form,
• Our website,
• Postal, cargo, courier,
• Face to face meetings,
• Other physical and electronic media.
7. PURPOSES OF PROCESSING PERSONAL DATA
As Hafsa Tur, we attach great importance to the privacy of your personal data and collect and process your personal data in accordance with the general principles and processing conditions specified in the KVK Law. In this context, we process your personal data limited to the following purposes:
• Providing our products and/or services and carrying out our sales processes,
• Carrying out our product and/or service purchasing processes,
• Execution of our customer relations processes,
• Managing our customer return and exchange request processes,
• Examining and evaluating customer demands and complaints and communicating if necessary,
• Carrying out activities aimed at customer satisfaction,
• Updating, customizing and developing our products and services in line with your needs and demands,
• Sending you e-mails, messages, newsletters and other publications about our new products or services, changes in our existing products or services, and our campaigns and promotions,
• Planning and executing our communication processes,
• Managing cookies in order to improve the experience of our visitors on our websites, detect requests and problems, and conclude their searches quickly. (For more detailed information, you can see our Cookie Policy),
• Conducting our marketing activities and advertising/campaign/promotion processes,
• Conducting and supervising our business activities and ensuring business continuity,
• Carrying out our activities and fulfilling our obligations in accordance with the agreements made with suppliers, business partners and other third parties,
• Execution of our performance management processes for suppliers,
• Carrying out our service, maintenance, repair and inspection works,
• Carrying out our repair and maintenance processes,
• Carrying out our financial and accounting affairs,
• Providing information to authorized public institutions and organizations when necessary,
• Ensuring that independent audits are carried out and managing the process,
• Following up on legal matters directed against our company,
• Ensuring the physical space security of our buildings and facilities and creating and tracking our visitor records,
• Ensuring compliance with legal regulations and fulfilling our legal obligations,
• Evaluating job applications of employee candidates, conducting interviews and meetings, and communicating with the people they indicate as references in their CVs.
8. OUR LEGAL REASONS FOR PROCESSING PERSONAL DATA
We process your personal data based on the following legal reasons:
• Situations where we obtain your explicit consent to process your personal data in accordance with Articles 5/1 and 6/2 of the KVK Law.
• In accordance with Article 5/2(a) of the KVK Law, it is clearly stipulated in the law.
• In accordance with Article 5/2(c) of the KVK Law, your personal data is required for the establishment or performance of a contract. For example, Hafsa Tur processes the personal data of its customers in order to provide services to its customers.
For example, Hafsa Tur processes the personal data of its customers in order to provide services to its customers. For example, Hafsa Tur logs the access records of the people to whom it provides internet access in accordance with Law No. 5651 and forwards them to the relevant administration upon request.
• In accordance with Article 5/2 (d) of the KVK Law, it has been made public by the relevant person herself. For example; Hafsa Tur processes the contact addresses of customers or potential customers made public on their websites in order to carry out purchasing, sales or marketing activities.
• Hafsa Tur’s establishment, use and protection of its own rights in accordance with Article 5/2(e) of the KVK Law. For example, it may keep personal data during the statute of limitations period, starting from the termination of the contractual relationship, in order to be able to defend itself in a possible dispute or lawsuit.
• In accordance with Article 5/2(f) of the KVK Law, it is necessary for the legitimate interest of the company. For example, Hafsa Tur processes the personal data of potential customers in order to answer these questions when potential customers ask questions about the products.
• In accordance with Article 6/3 c.2 of the KVK Law, the law provides for special categories of personal data. For example, processing of relevant personal data in terms of notifiable diseases.
• In accordance with Article 6/3 c.3 of the KVK Law, processing of personal data other than health and sexual life by persons or authorized institutions and organizations under the obligation of confidentiality in cases stipulated by law. For example, the collection and storage of health reports by OSGB.
9. TRANSFER OF PERSONAL DATA
We may process your personal data with our employees, business partners, group companies, suppliers, company representatives, officials and legally authorized public/private institutions and organizations in line with our purposes specified in Section 7, in accordance with the processing conditions specified in Articles 8 and 9 of the KVK Law. We will be able to transfer it to organizations.
For example, as Hafsa Tur,
• Due to the corporate identity of our company, we can share the requests and complaints from our customers with our group companies in order to take the necessary actions in the most efficient way.
• We can share the data we collect from our customers with our suppliers in order to provide our services.
• If the events occurring on our company campuses have a judicial nature, we can share the necessary information with authorized public institutions and organizations.
Hafsa Tur may share your personal data with third parties abroad if one of the following conditions is met:
• If you give explicit consent to the transfer activity abroad,
• If there is adequate protection in the country to which we will transfer personal data, or
• If there is no adequate protection in the country, the party to whom the personal data will be transferred commits in writing to adequate protection and the KVK Board approves this commitment.
10. STORAGE AND DESTRUCTION OF PERSONAL DATA
Your personal data processed for the purposes set out in this Policy will be stored and destroyed in accordance with the KVK Law and the Regulation on Deletion, Destruction or Anonymization of Personal Data. Hafsa Tur stores and destroys your personal data in accordance with Hafsa Tur Personal Data Storage and Destruction Policy. You can request our Personal Data Storage and Destruction Policy via [email protected] to learn about the measures we take to securely store and destroy your personal data and the storage and destruction periods we set.
11. ENSURING THE SECURITY OF YOUR PERSONAL DATA
As Hafsa Tur, we ensure the security of the personal data we process while providing our services in accordance with the KVK Law and relevant legislation. In this context, Hafsa Tur takes appropriate security measures and incorporates the necessary security technologies to ensure the legality of the personal data it processes, to prevent unlawful access and to ensure its preservation. Hafsa Tur has prepared and implemented a Personal Data Security Policy regarding the technical and administrative measures taken to ensure the security of personal data.
In addition, we take some additional technical and administrative measures to ensure the security of the special personal data we process as the data controller. Hafsa Tur has prepared and implemented the Processing and Security of Special Personal Data Policy in order to determine these measures.
Hafsa Tur ensures the security of processed personal data by acting in accordance with the two policies mentioned in this section and generally accepted good practices.
12. YOUR RIGHTS AND APPLICATION REGARDING YOUR PERSONAL DATA
As the Relevant Person, you have the following rights regarding your personal data in accordance with Article 11 of the KVK Law:
• Learning whether your personal data is being processed or not,
• Requesting information if your personal data has been processed,
• Learning the purpose of processing personal data and whether they are used for their intended purpose,
• Knowing the third parties to whom your personal data is transferred at home or abroad,
• Requesting correction of your personal data if it has been processed incompletely or incorrectly, and requesting that the action taken in this context be notified to third parties to whom your personal data has been transferred,
• Requesting the deletion or destruction of your personal data in case the reasons requiring processing no longer exist, even though it has been processed in accordance with the Personal Data Protection Law No. 6698 and other relevant legal provisions, and requesting that the action taken in this context be notified to third parties to whom your personal data has been transferred,
• Object to the emergence of a result against you by analyzing the processed data exclusively through automatic systems,
• Request compensation for this damage if you suffer damage due to unlawful processing of personal data.
You can submit your requests regarding these rights via the Relevant Person Application Form on our website.
Your application will be processed free of charge. However, if the requested transaction requires an additional cost, the fees in the tariff determined by the Personal Data Protection Board will be requested from the applicant.
Your applications will be answered in writing or electronically as soon as possible and within thirty days at the latest, depending on the nature of the request. If your request is rejected, your application will be answered with reasons.
13. REFERENCES AND BASIS
• Personal Data Protection Law
14. RELATED DOCUMENT
• Personal Data General Information Text
• Cookie Policy
• Personal Data Storage and Destruction Policy
• Personal Data Security Policy
• Policy on Processing and Security of Special Personal Data