Privacy Statement For Call Center Processes

Data Controller

Your personal data is processed by our Company, as the data controller, in accordance with the provisions of the Law on Personal Data Protection No. 6698 (“Law”) and within the framework of this Privacy Statement for Call Center Processes (“Privacy Statement”).

Our Company respects your privacy and your rights regarding the protection of your personal data and strives to establish and maintain a relationship of trust with you. In this context, our Company processes your personal data in accordance with the provisions of all legislation regarding the protection of personal data, in particular Law, and takes all necessary security measures to ensure security of your data. This Privacy Statement explains the scope of processing of your personal data collected within the framework of your request / complaint / suggestion application that you will communicate with our Company through the call centre.

Methods of Collecting Your Personal Data

Your personal data is collected by our Company electronically through the call center (telephone channel).

Categories of Processed Personal Data and Purposes and Legal Reasons for Processing Your Personal Data

Incoming/outgoing call management at the call center; management of collecting, evaluating, and resolving requests/complaints/suggestions through the call center; management of relations and satisfaction of request/complaint/suggestion owners; improvement of the request/complaint/suggestion owner experience and quality standards management, including product/service/process improvement; information security management; audit and internal audit management; operations management; legal compliance and management of disputes the Company is involved in and/or related to (e.g., litigation, enforcement, mediation); legal and consultancy management; and personal data processing within the scope of data retention and archiving processes. The categories of personal data processed, the purposes and legal reasons for processing such personal data are explained in detail below.

Personal Data Category	Purposes of Processing Personal Data and Legal Reasons for Processing
Identity Data	Your personal data in this category are processed within the scope of the personal data processing conditions (legal reasons) and for the following purposes, provided that it is directly related to the establishment or performance of a contract in accordance with subparagraph (c) of paragraph 2 of Article 5 of the Law, that data processing is mandatory for the data controller to fulfill its legal obligation in accordance with subparagraph (ç), that data processing is mandatory for the establishment, exercise, or protection of a right in accordance with subparagraph (e), and that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject in accordance with subparagraph (f): Performance of Information Security Processes Performance of the Audit / Ethics Activities Performance of Activities in Accordance with Legislation Following Up and Performance of the Legal Affairs Conducting Internal Audit / Investigation / Intelligence Activities Performance of Communication Activities Performance/Audit of the Business Activities Receiving and Evaluating Suggestions for Improvement of Business Processes Performance of Business Continuity Ensuring Activities Performance of Goods / Services After Sales Support Services Performance of Goods / Services Production and Operation Processes Performance of Customer Relationship Management Processes Performance of Activities for Customer Satisfaction Performance of Storage and Archive Activities Performance of Contract Processes Following Up of Requests / Complaints Providing Information to Authorised Persons, Institutions and Organisations
Contact Data	Your personal data in this category are processed within the scope of the personal data processing conditions (legal reasons) and for the following purposes, provided that it is directly related to the establishment or performance of a contract in accordance with subparagraph (c) of paragraph 2 of Article 5 of the Law, that data processing is mandatory for the data controller to fulfill its legal obligation in accordance with subparagraph (ç), that data processing is mandatory for the establishment, exercise, or protection of a right in accordance with subparagraph (e), and that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject in accordance with subparagraph (f): Performance of the Audit / Ethics Activities Following Up and Performance of the Legal Affairs Conducting Internal Audit / Investigation / Intelligence Activities Performance of Communication Activities Performance/Audit of the Business Activities Receiving and Evaluating Suggestions for Improvement of Business Processes Performance of Business Continuity Ensuring Activities Performance of Goods / Services After Sales Support Services Performance of Goods / Services Production and Operation Processes Performance of Customer Relationship Management Processes Performance of Activities for Customer Satisfaction Performance of Storage and Archive Activities Performance of Contract Processes Following Up of Requests / Complaints Providing Information to Authorised Persons, Institutions and Organisations
Customer Transaction Data (It is only processed if you are our customer.)	Your personal data in this category are processed within the scope of the personal data processing conditions (legal reasons) and for the following purposes, provided that it is directly related to the establishment or performance of a contract in accordance with subparagraph (c) of paragraph 2 of Article 5 of the Law, that data processing is mandatory for the data controller to fulfill its legal obligation in accordance with subparagraph (ç), that data processing is mandatory for the establishment, exercise, or protection of a right in accordance with subparagraph (e), and that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject in accordance with subparagraph (f): Performance of the Audit / Ethics Activities Following Up and Performance of the Legal Affairs Conducting Internal Audit / Investigation / Intelligence Activities Performance/Audit of the Business Activities Receiving and Evaluating Suggestions for Improvement of Business Processes Performance of Business Continuity Ensuring Activities Performance of Goods / Services After Sales Support Services Performance of Goods / Services Production and Operation Processes Performance of Customer Relationship Management Processes Performance of Activities for Customer Satisfaction Performance of Storage and Archive Activities Performance of Contract Processes Following Up of Requests / Complaints Providing Information to Authorised Persons, Institutions and Organisations
Transaction Security Data	Your personal data in this category are processed within the scope of the personal data processing conditions (legal reasons) and for the following purposes, provided that data processing is mandatory for the data controller to fulfill its legal obligation in accordance with subparagraph (ç) of paragraph 2 of Article 5 of the Law, that data processing is mandatory for the establishment, exercise, or protection of a right in accordance with subparagraph (e), and that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject in accordance with subparagraph (f): Performance of Information Security Processes Performance of the Audit / Ethics Activities Performance of Activities in Accordance with Legislation Following Up and Performance of the Legal Affairs Conducting Internal Audit / Investigation / Intelligence Activities Performance/Audit of the Business Activities Receiving and Evaluating Suggestions for Improvement of Business Processes Performance of Contract Processes Following Up of Requests / Complaints Providing Information to Authorised Persons, Institutions and Organisations
Request / Complaint / Suggestion Data	Your personal data in this category are processed within the scope of the personal data processing conditions (legal reasons) and for the following purposes, provided that it is directly related to the establishment or performance of a contract in accordance with subparagraph (c) of paragraph 2 of Article 5 of the Law, that data processing is mandatory for the data controller to fulfill its legal obligation in accordance with subparagraph (ç), that data processing is mandatory for the establishment, exercise, or protection of a right in accordance with subparagraph (e), and that data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject in accordance with subparagraph (f): Performance of Information Security Processes Performance of the Audit / Ethics Activities Following Up and Performance of the Legal Affairs Conducting Internal Audit / Investigation / Intelligence Activities Performance/Audit of the Business Activities Receiving and Evaluating Suggestions for Improvement of Business Processes Performance of Business Continuity Ensuring Activities Performance of Goods / Services After Sales Support Services Performance of Goods / Services Production and Operation Processes Performance of Customer Relationship Management Processes Performance of Activities for Customer Satisfaction Performance of Storage and Archive Activities Performance of Contract Processes Following Up of Requests / Complaints Providing Information to Authorised Persons, Institutions and Organisations

Transferring Your Personal Data to Domestic and/or Abroad Third Parties

Within our Company, your personal data may only be accessed by our employees who have limited access authorization for the purposes detailed above, to the extent necessary to perform their duties, and in cases where the conditions for transfer specified in Articles 8 and 9 of the Law are not present, your personal data are not transferred to domestic and/or overseas third parties. However, your personal data processed within the scope of each of the above-mentioned personal data categories may be transferred to the following recipient groups in accordance with Articles 8 and 9 of the Law and provided that the above-mentioned personal data processing conditions (legal reasons) for the relevant data category also exist in terms of the transfer purposes:

Primarily for the purpose of procuring products and/or services for the performance of Company activities, your personal data limited to the personal data categories of identity, contact, customer transaction, transaction security and request / complaint / suggestion data may be transferred to our domestic and/or abroad suppliers (e.g. call centre service providers, information technologies and data hosting service providers) for the purposes specified in the relevant category for each data category above;
Primarily for the purpose of fulfilling our Company’s legal obligations and to follow up on its legal affairs, your personal data limited to the personal data categories of identity, contact, customer transaction, transaction security and request / complaint / suggestion data, may be transferred to authorized public institutions and organizations (e.g. courts, notary publics, tax offices).

Processing Period of Your Personal Data

Your personal data obtained during our Company activities are stored and destroyed in accordance with the general principles and regulations specified in our Company’s policies and procedures regarding storage and destruction prepared in accordance with the provisions of the Constitution, Law, Regulation on the Erasure, Destruction, or Anonymization of Personal Data, and other relevant legislation.

In this context, your personal data shall be destroyed if all of the above personal data processing conditions are eliminated. Accordingly, your personal data shall continue to be processed during the relevant legal limitation periods specific to the process. We kindly request you to review Section 6 of this Privacy Statement regarding your requests for the destruction of your personal data.

Your Rights within the Scope of Law

We inform you that you, as a personal data owner, have the following rights pursuant to Article 11 of the Law:

To learn whether your personal data have been processed or not,
To demand for information as to whether your personal data have been processed,
To learn the purpose of the processing of your personal data and whether these personal data have been used in compliance with the purpose,
To know the third parties to whom your personal data have been transferred in the country or abroad,
To request the rectification of your personal data in case of incomplete or inaccurate processing and to request reporting of the transaction carried out within this scope to third parties to whom your personal data have been transferred,
Although it has been processed in accordance with the provisions of the Law and other relevant laws, to request the deletion or destruction of your personal data in the event that the reasons requiring its processing disappear, and to request reporting of the transactions carried out within this scope and in case of incomplete or incorrect processing of your personal data to third parties to whom your personal data have been transferred,
To object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
To claim compensation for the damage arising from the unlawful processing of his/her personal data.

You can send your applications for your above-mentioned rights to our Company in accordance with the procedures and principles set out in the relevant legislation by filling out the Data Owner Application Form, in accordance with the provisions of the Communiqué on the Principles and Procedures of Application to the Data Controller (in writing or via registered electronic mail (KEP) address, secure electronic signature, mobile signature or your e-mail address that has been registered in our systems and that you have previously notified to our Company, along with the information/documents * (such as TR ID number or passport number for citizens of other countries, residence address/workplace for notification, mobile phone/telephone/fax number, e-mail address) confirming your identity in order to enable our Company to electronically determine that you are the real right owner). Depending on the nature of your request, your applications will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest; however, if the transaction requires an additional cost, you may be requested with a charge according to the tariff to be determined by the Personal Data Protection Board.

* We would like to remind you that any sensitive personal data (such as the details about your race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, clothing and attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, biometric data, genetic data) should not be included in the scope of these documents.