INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
As KAPACK PLASTİK KOZMETİK SANAYİ VE TİCARET A.Ş., we would like to inform you about the Law on the Protection of Personal Data No. 6698 (KVKK), which regulates the principles and procedures to be followed by natural and legal persons who process personal data, and aims primarily to protect the fundamental rights and freedoms of individuals, especially the right to privacy.
Data Controller
In accordance with the Law on the Protection of Personal Data No. 6698 (“Law No. 6698”), your personal data may be processed by KAPACK PLASTİK KOZMETİK SANAYİ VE TİCARET A.Ş., acting as the data controller, within the scope outlined below. “Processing of Personal Data” refers to any operation performed on personal data such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, acquiring, making available, classifying, or preventing their use.
Our company is obliged to comply with the provisions of Law No. 6698, and all personal data processed within the scope of our activities are subject to this law.
General Principles of Personal Data Processing
Our company complies with the general principles set forth in Law No. 6698 when processing personal data. These principles are as follows:
1) Being lawful and fair,
2) Being accurate and up to date when necessary,
3) Being processed for specific, explicit, and legitimate purposes,
4) Being relevant, limited, and proportionate to the purposes for which they are processed,
5) Being stored only for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
Your personal data may be collected verbally, in writing, or electronically by automatic or non-automatic means through our company’s offices, branches, dealers, call center, website, social media platforms, mobile applications, and similar channels depending on the products or services you receive or our commercial activities.
In addition, when you visit our website or participate in our training sessions, seminars, events, and meetings, your personal data may be processed.
Legal Basis for Collecting Personal Data
Your personal data is collected verbally, in writing, or electronically for the purposes stated above so that we can provide the products and services offered by our company in compliance with legal obligations and fulfill our contractual and legal responsibilities completely and accurately. The personal data collected for this legal reason may also be processed and transferred for the purposes stated in this notice in accordance with Articles 5 and 6 of the Law on the Protection of Personal Data.
Personal data may be used by our company for the following purposes:
- Improving the services provided and developing new services and providing information related to them,
- For customers and prospective customers with prior electronic communication consent; promoting and marketing campaigns and services,
- Resolving customer problems and complaints,
- Conducting statistical analyses and market research,
- Defining and implementing the company’s commercial and business strategies,
- Managing relationships with member businesses and business partners,
- Tracking accounting and payment processes,
- Managing legal processes and ensuring compliance with legislation,
- Responding to requests from administrative and judicial authorities,
- Planning internal reporting and business development activities,
- Conducting financial control and reporting and fulfilling legal notifications,
- Managing internal control and audit processes,
- Ensuring information and transaction security and preventing malicious use,
- Making necessary updates to ensure the accuracy and currency of processed data,
- Carrying out all processes related to the purposes mentioned above.
Transfer of Processed Personal Data
Our company may share your personal data with our domestic and international business partners, member businesses, banks, financial institutions, independent audit firms, and other persons or institutions permitted by the Payment and Securities Reconciliation Systems, Payment Services and Electronic Money Institutions Law and other legal provisions. Stored data may be transferred under the conditions and purposes set forth in Articles 8 and 9 of the Law.
Records and documents regarding transactions carried out with our customers are subject to a statutory retention period. If you request the deletion of your personal data, this request can only be fulfilled at the end of the legal retention period. During this period, your personal data will not be processed or shared with third parties except as required by legal obligations.
Rights of the Personal Data Subject as Stated in Article 11 of the Law
If you, as the data subject, submit your requests regarding your rights to our Company in accordance with the methods set out in this Information Notice, your request will be concluded free of charge within thirty days at the latest, depending on its nature. However, if the Personal Data Protection Board stipulates a fee, our company will charge the fee determined in the tariff. Within this scope, personal data subjects have the right to:
- Learn whether their personal data is processed,
- Request information if their personal data has been processed,
- Learn the purpose of processing personal data and whether they are used in line with this purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request the correction of personal data if it is incomplete or inaccurate, and request notification of the correction to third parties to whom the data has been transferred,
- Request the deletion or destruction of personal data in case the reasons for processing no longer exist, despite being processed in accordance with the law and relevant legislation, and request notification of the process to third parties to whom the data has been transferred,
- Object to the occurrence of a result against them by analyzing the processed data exclusively through automated systems,
- Request compensation for damages if they suffer damage due to the unlawful processing of personal data.
To exercise the above rights, you may submit your request along with the necessary identity verification information and your explanations regarding the right you wish to exercise, as specified in Article 11 of the Law, to the Personal Data Protection Authority in accordance with the Communiqué on the Principles and Procedures of Application to the Data Controller.