KVKK Disclosure Text

PERSONAL DATA PROTECTION CUSTOMER DISCLOSURE TEXT

Data Controller: BUOYANT GIDA SAN. VE TİC. LTD. ŞTİ. (Address: FATİH SULTAN MAH. 2702 CAD. EVREN PARK SİTESİ A BLOK NO:2 A İÇ KAPI NO:3 ETİMESGUT / ANKARA Tel: +90 537 725 45 75 Website: www.buooyant.com (WHATSAPP LINE), E-mail: [email protected], Mersis No: 0611070372400001) is responsible for fulfilling the illumination obligation regarding the protection of personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”) and the Communique on Procedures and Principles for the Fulfillment of the Disclosure Obligation (hereinafter referred to as the "Communique"). This disclosure text is prepared and published for the purpose of informing our customers about the procedures and principles to be followed regarding the protection of their personal data in their relationship with our institution.

KVKK Article 10: "During the collection of personal data, the data controller or the person authorized by the data controller is obliged to inform the relevant persons about the identity of the data controller and, if applicable, their representative, the purpose of processing personal data, to whom and for what purpose the processed personal data may be transferred, the method of collecting personal data, the legal grounds, and the other rights listed in Article 11."

KEY DEFINITIONS IN THE LAW

Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, safeguarding, changing, reordering, disclosing, transferring, receiving, making available, classifying, or preventing the use of such data, either partially or fully by automatic means or non-automatic means that are part of a data recording system.
Data Controller: The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Recording System (VERBIS): The system in which personal data is processed according to certain criteria.
Explicit Consent: Consent that is provided based on being informed and given freely for a specific purpose.
Board: Refers to the Personal Data Protection Board.

PERSONAL DATA OF CUSTOMERS

Our company may process the personal data of customers in accordance with the purposes and processing conditions stated in this text. The personal data processed include:

Identity Data: Name, surname, mother-father's name, date of birth, Turkish ID number, gender, marital status, identity card series and number, nationality, passport information, title, and position.
Contact Data: Phone number, e-mail address, address information, internal company contact information (company phone number, extension phone number, corporate e-mail address, registered e-mail address).
Financial Data: Bank IBAN number, fees and details, debt information.
Visual and Auditory Data: Photographs of the real person, video recordings.
Other Data: Invoice-promissory note-check information, order details, shopping history, IP address information, website login and logout records, handwritten signatures, complaint requests, and other details.

PURPOSE OF PROCESSING PERSONAL DATA BY BUOYANT GIDA SANAYİ VE TİCARET LTD. ŞTİ.

In accordance with Article 10 of the KVKK and Article 5 of the Communique, personal data of customers may be processed for the following purposes in compliance with the processing conditions stated in Article 4 of the KVKK:

Fulfilling service obligations under service contracts,
Ensuring legal and commercial security of individuals related to our institution,
Providing information about changes in service conditions,
Resolving customer complaints and processing data access or correction requests,
Organizing and maintaining all records and documents that will serve as a basis for transactions, whether electronic (internet/mobile, etc.) or on paper,
Managing contractual processes as required by the Turkish Civil Code, the Commercial Code, and other applicable legislation,
Executing sponsorship activities,
Fulfilling legal obligations and exercising rights arising from applicable legislation,
Providing information to authorized persons, institutions, and organizations,
Managing emergency situations,
Carrying out communication activities,
Handling accounting and financial operations,
Managing organization and event planning,
Conducting information security processes,
Undertaking storage and archiving operations,
Ensuring physical security of premises.

METHOD OF PERSONAL DATA COLLECTION AND LEGAL BASIS

Personal data may be obtained directly from the relevant individual, from third parties, or legal authorities during the establishment of a legal relationship. In this context, personal data may be collected through contracts, e-mails, application forms, and through written, oral, or electronic communications with our company.

In accordance with Article 5 of the KVKK, personal data cannot be processed without the explicit consent of the individual. However, the law specifies certain exceptions where explicit consent is not required, such as cases directly related to the establishment or performance of a contract, when processing is necessary for the company to fulfill its legal obligations, when data has been made public by the individual, or when processing is required for the establishment, exercise, or defense of a legal claim, or when necessary for the legitimate interests of the data controller without infringing on the fundamental rights and freedoms of the individual.

In order for Malatya Pazarı Palancı Kuruyemiş San. ve Tic. A.Ş. to continue its operations, personal data will be processed for the purposes and under the conditions specified in Articles 5 and 6 of the KVKK and other relevant legislation.

WHO PERSONAL DATA MAY BE SHARED WITH AND FOR WHAT PURPOSE

Personal data may be shared with third parties, including suppliers, shareholders, authorized vendors, service providers (for audit, event organization, legal, etc.), independent audit firms, financial institutions, direct and indirect affiliates, and storage, archiving, IT support companies, among others, both domestically and internationally, as required for the realization of the purposes listed above and in accordance with the data transfer and processing conditions stated in Articles 8 and 9 of the KVKK. Data sharing will be carried out with sufficient and effective precautions in place to ensure confidentiality and security.

STORAGE PERIOD OF PERSONAL DATA

In accordance with the KVKK, personal data processed for the purposes outlined in this "Personal Data Processing Disclosure Text" will be deleted, destroyed, or anonymized when the purpose of processing no longer exists or when statutory retention periods have expired, in line with the Personal Data Retention and Destruction Policy.

RIGHTS OF THE DATA SUBJECT

The data subject has the following rights:

To learn whether their personal data is being processed,
To request information about the processing of their personal data,
To understand the purpose of processing personal data and whether it is being used appropriately,
To know the third parties to whom their personal data is being transferred, both domestically and abroad,
To request correction of inaccurate or incomplete personal data,
To request the deletion or destruction of personal data when the reasons for processing no longer exist,
To request the notification of third parties to whom their personal data has been transferred, regarding the correction or deletion of their data,
To object to decisions based solely on automated processing of personal data,
To request compensation for damages caused by unlawful processing of personal data.

EXCEPTIONS TO THE RIGHT TO APPLY

Pursuant to Article 28/2 of the KVKK, the data subject will not be able to exercise the rights listed in Article 11 of the KVKK in the following cases, except for the right to claim compensation:

When processing is necessary for the prevention of crime or the conduct of a criminal investigation,
When personal data has been made public by the data subject.

APPLICATION METHOD AND FORM

The data subject can submit their requests regarding their rights in the form specified in the "Communique on Procedures and Principles for the Fulfillment of the Disclosure Obligation" by using one of the methods outlined below.

Requests will be responded to within 30 days from the date the request is received by the company, in accordance with Article 13 of the KVKK and Article 5 of the Communique on Procedures and Principles for the Fulfillment of the Disclosure Obligation.

APPLICATION METHODS:

Written Application

By applying personally with a wet signature or through a Notary:
Address: FATİH SULTAN MAH. 2702 CAD. EVREN PARK SİTESİ A BLOK NO:2 A İÇ KAPI NO:3 ETİMESGUT / ANKARA
The envelope/notification must be labeled as “Personal Data Protection Law Information Request.”

Email Application Using the Registered Email Address

By using the e-mail address registered in the Malatya Pazarı Palancı system:
Email: [email protected]
Subject: "Personal Data Protection Law Information Request."

Email Application Using a Non-Registered Email Address

By using a mobile signature/e-signature through an email address not registered in the Malatya Pazarı Palancı system:
Email: [email protected]
Subject: "Personal Data Protection Law Information Request."

NOTIFICATION METHOD

If the request is accepted, it will be immediately fulfilled, and the response will be sent either in writing or electronically.

COMMUNIQUE ON THE PROCEDURES AND PRINCIPLES FOR THE FULFILLMENT OF THE DISCLOSURE OBLIGATION - ARTICLE 7

FEES:

There will be no charge for up to 10 pages. For more than 10 pages, a processing fee of 1 Turkish Lira per page may apply.
If the response is provided in a CD, flash drive, or similar medium, the cost of the medium will be charged.