1. PURPOSE AND SCOPE
These Privacy and Personal Data Protection Principles (the “Principles”) set out the principles adopted by Canlar Mekatronik San. ve Tic. A.Ş. (referred to as “CANLAR MEKATRONİK”, the “Company” or the “Data Controller”) in relation to the protection of personal data, establish the personal data processing principles applicable to the processing of personal data belonging to Prospective Customers and Online Visitors (the “Data Subject Groups”), and are intended to inform those groups.
2. PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA
As CANLAR MEKATRONİK, acting in the capacity of Data Controller, we process your personal data within the framework of the following principles.
2.1 Processing Lawfully and in Compliance with the Rule of Good Faith
In the processing of your personal data, we act in accordance with the principles introduced by legal regulations and with the general rules of trust and good faith.
2.2 Ensuring that Personal Data is Accurate and, Where Necessary, Kept Up to Date
Taking your legitimate interests into account, periodic checks and updates are carried out to ensure that the data processed is accurate and up to date, and the necessary measures are taken accordingly. Within this scope, systems for verifying the accuracy of personal data and for making the necessary corrections are established within CANLAR MEKATRONİK.
2.3 Processing for Specified, Explicit and Legitimate Purposes
Your personal data is processed on the basis of explicit, specified and legitimate data processing purposes.
2.4 Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed
Your personal data is processed in a manner that is proportionate, relevant and limited to what is necessary to achieve the intended purpose(s), and the processing of personal data that is unrelated to, or not required for, the achievement of that purpose is avoided.
2.5 Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose of Processing
Your personal data is retained only for the period stipulated in the relevant legislation or required for the purpose for which it is processed. Within this scope, it is first determined whether the relevant legislation stipulates a retention period for the personal data; where a period has been specified, that period is observed, and where no period has been specified, personal data is retained for as long as is necessary for the purpose for which it is processed. Upon expiry of the period, or where the reasons requiring the processing cease to exist, and where there is no legal ground permitting longer processing, your personal data is deleted, destroyed or anonymised in accordance with CANLAR MEKATRONİK’s Personal Data Retention and Destruction Policy.
3. CONDITIONS FOR PROCESSING PERSONAL DATA
Your personal data is processed by CANLAR MEKATRONİK within the framework of the conditions set out below.
3.1 Expressly Provided for by Law
Where the processing of personal data is expressly provided for by law, your personal data may be processed.
3.2 Inability to Obtain the Explicit Consent of the Data Subject Due to Actual Impossibility
Where it is compulsory to process personal data in order to protect the life or physical integrity of the data subject or of another person, and the data subject is physically unable to give consent or whose consent cannot be given legal validity, your personal data may be processed.
3.3 Being Directly Related to the Conclusion or Performance of a Contract
Where it is necessary to process the personal data of the parties to a contract, provided that the processing is directly related to the conclusion or performance of that contract, your personal data may be processed.
3.4 Fulfilment of CANLAR MEKATRONİK’s Legal Obligations
Where processing is compulsory in order for the Company, as Data Controller, to fulfil its legal obligations, your personal data may be processed.
3.5 Personal Data Made Public by the Data Subject
Where your personal data has been made public by you, it may be processed.
3.6 Processing Being Compulsory for the Establishment or Protection of a Right
Where data processing is compulsory for the establishment, exercise or protection of a right, your personal data may be processed.
3.7 Processing on the Basis of Legitimate Interests
Where data processing is necessary for the legitimate interests of CANLAR MEKATRONİK, your personal data may be processed.
3.8 Processing on the Basis of Explicit Consent
Where your personal data cannot be processed on the basis of any of the conditions set out in these Principles, it is processed on the basis of your explicit consent.
4. CATEGORISATION OF PERSONAL DATA
| Data Subject | Data Category | Data Types |
| Prospective Customer | Identity | Name and surname |
| Contact | E-mail, home / mobile / business telephone | |
| Transaction Security | IP address, website entry, exit and browsing information, password and passcode information | |
| Customer | Identity | Name, surname, Turkish ID number, place and date of birth, marital status, gender, identity document details, driving licence details |
| Contact | Address, e-mail, mobile / home / business telephone | |
| Financial Information | Credit card details, debit card details | |
| Data Security | IP address, website entry, exit and browsing information, password and passcode information | |
| Third Party | Identity | Name, surname, Turkish ID number, place and date of birth, marital status, gender, identity document details |
| Contact | Address, mobile / home / business telephone | |
| Financial Information | Credit card details, debit card details | |
| Data Security | IP address, website entry, exit and browsing information, password and passcode information | |
| Online Visitor | Identity | Name and surname |
| Contact | E-mail, telephone / mobile telephone | |
| Transaction Security | IP address, website entry, exit and browsing information, password and passcode information |
5. PURPOSES OF PROCESSING PERSONAL DATA
At CANLAR MEKATRONİK, personal data may be processed for the purposes set out below according to the relevant data subject group, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698.
5.1. PROSPECTIVE CUSTOMER
Personal data of Prospective Customers may be processed, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, for the purposes of carrying out the work necessary for the performance of the commercial activities conducted by the Company and running the related business processes; carrying out the work and related business processes necessary to enable data subjects to benefit from the products and services offered by the Company; planning and performing the activities required for the tailored recommendation and promotion of the products and services offered by the Company; and planning and performing customer relationship management processes.
5.2. CUSTOMER
Personal data of Customers may be processed, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, for the purposes of carrying out the work necessary for the performance of the commercial activities conducted by the Company; planning and performing business activities; planning and performing activities for the analysis of the effectiveness, efficiency and appropriateness of business activities; planning and performing activities to ensure business continuity; and planning and performing customer relationship management processes.
5.3. THIRD PARTY
Personal data of Third Parties who are credit card holders may be processed, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, for the purposes of carrying out the work necessary for the performance of the commercial activities conducted by the Company and running the related business processes; carrying out payment and invoicing transactions relating to another person who benefits from the products and services offered by the Company; and planning and performing customer relationship management processes.
5.4. ONLINE VISITOR
Personal data of Online Visitors may be processed, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, for the purposes of conducting marketing analysis activities; conducting advertising, campaign and promotion processes; conducting communication activities; conducting product and service development activities; and fulfilling legal obligations.
6. TRANSFER OF PERSONAL DATA
Your personal data may be transferred, on a limited basis, to our business partners and to legally authorised public institutions and private persons, within the framework of the principles and purposes set out in Articles 3 and 5 of these Principles and the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698.
7. METHOD AND LEGAL GROUNDS OF PERSONAL DATA COLLECTION
Personal data transmitted to CANLAR MEKATRONİK by electronic means is processed as follows according to the relevant data subject group.
7.1. PROSPECTIVE CUSTOMER
Personal data of Prospective Customers is processed by automated means, through the completion of an application form in electronic form, the completion of a physical form, or by being obtained directly from the data subject or from a third party as part of a data recording system, on the legal grounds set out in Article 5 of Law No. 6698, namely “the data having been made public by the data subject”, “processing being compulsory for the establishment, exercise or protection of a right”, “processing being compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” and “processing being compulsory for the data controller to fulfil its legal obligations”.
7.2. CUSTOMER
Personal data of Customers is processed by automated means, through the completion of an application form in electronic form, the completion of a physical form, or by being obtained directly from the data subject or from a third party as part of a data recording system, on the legal grounds set out in Article 5 of Law No. 6698, namely “it being necessary to process the personal data of the parties to a contract, provided that the processing is directly related to the conclusion or performance of that contract”, “processing being compulsory for the data controller to fulfil its legal obligations” and “processing being compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
7.3. THIRD PARTY
Personal data of Third Parties who are credit card holders is processed by automated means, through the completion of an application form in electronic form, the completion of a physical form, or by being obtained directly from the data subject or from a third party as part of a data recording system, on the legal grounds set out in Article 5 of Law No. 6698, namely “processing being compulsory for the establishment, exercise or protection of a right” and “processing being compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”.
7.4. ONLINE VISITOR
Personal data of Online Visitors is processed by automated means, through the completion of an application form in electronic form, the completion of a physical form, or by being obtained directly from the data subject or from a third party as part of a data recording system, on the legal grounds set out in Article 5 of Law No. 6698, namely “processing being compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” and “processing being compulsory for the data controller to fulfil its legal obligations”.
8. SECURITY OF PERSONAL DATA
8.1 Canlar Mekatronik takes reasonable measures to ensure the security of personal data and to prevent its unlawful processing, so as to prevent unauthorised access risks, accidental loss of data, the deliberate deletion of data or damage to data.
8.2 All necessary technical and physical measures are taken to prevent persons other than those authorised to access personal data from accessing it. In particular, the authorisation system is designed in such a way that no person is able to access more personal data than is necessary.
8.3 Canlar Mekatronik carries out, and arranges for, the audits necessary to ensure the implementation of the provisions of Law No. 6698 within its own organisation.
9. UNDERTAKINGS REGARDING THIRD PARTY PERSONAL DATA
The Data Subject Group accepts and consents that personal information relating to third parties which it transmits may be processed by CANLAR MEKATRONİK. The relevant Data Subject Group further undertakes that it has provided the necessary information to, and obtained the necessary permissions from, the persons whose data it has transmitted, in accordance with Personal Data Protection Law No. 6698. Any damages arising otherwise shall remain the responsibility of the relevant Data Subject Group.
10. APPLICATION PROCEDURES AND PRINCIPLES
As a data subject, you may submit your requests under Article 11 of Law No. 6698, which governs the rights of the data subject, to CANLAR MEKATRONİK in accordance with the conditions set out in the “CANLAR MEKATRONİK DATA SUBJECT (PERSONAL DATA OWNER) APPLICATION FORM FOR THE PROTECTION OF PERSONAL DATA”: in writing, bearing a wet-ink signature, delivered in person or via a notary public to …………………………………………., or by e-mail containing a mobile signature / electronic signature sent to ………………….. The CANLAR MEKATRONİK DATA SUBJECT (PERSONAL DATA OWNER) APPLICATION FORM FOR THE PROTECTION OF PERSONAL DATA ………………………………………………………………………………………….. can be accessed on the website or requested directly from the contact e-mail address.
In this context, as a data subject you have the right to:
- learn whether your personal data is being processed,
- request information about it if your personal data has been processed,
- learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
- know the third parties, in Turkey or abroad, to whom your personal data has been transferred,
- request the correction of your personal data if it has been processed incompletely or inaccurately,
- request the erasure or destruction of your personal data within the conditions stipulated in the relevant legislation,
- request that the third parties to whom your personal data has been transferred be notified of such correction, erasure or destruction,
- object to any outcome to your detriment arising from the analysis of the processed data exclusively by automated systems,
- claim compensation for damage suffered as a result of the unlawful processing of your personal data.