Disclosure Statement and Explicit Consent Declaration within the Framework of the Personal Data Protection Law

Information Text on Protection and Processing of Personal Data

1. Introduction 1.1. We, Atış Holding Inc. (“Atış Holding” or “Company”), act as the Data Controller within the scope of the Personal Data Protection Law No. 6698 (“PDPL”), published in the Official Gazette dated April 7, 2016 and numbered 29677, in order to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, and to determine the obligations of real and legal persons processing personal data.

1.2. As Atış Holding Inc., this document has been prepared to ensure that the personal data of users are processed in compliance with the relevant legislation, primarily the Constitution of the Republic of Turkey, international agreements related to human rights to which our country is a party, and Law No. 6698 on the Protection of Personal Data (KVKK). All personal data shared with our company may be processed in accordance with the law, in connection with our activities and service purposes, and proportionate.

1.3. Protection of personal data is among the fundamental policies of our Company. Throughout the existence of our companies, we have prioritized the confidentiality of personal data, adopted it as a working principle, and instructed our employees accordingly. Our Company undertakes to comply with all responsibilities imposed by the PDPL. With full awareness of this responsibility and as the Data Controller, we process, record, transfer, share, and store your personal data within the framework explained below and within the limits prescribed by the official legislation.

1. Definitions 2.1. The terms “personal data,” “special categories of personal data,” and “data processing” used in the information text are used in accordance with the definitions made in the PDPL. As mentioned in the PDPL:

2.1.1. Personal Data Protection Law (“PDPL”): Law No. 6698 on the Protection of Personal Data, which entered into force by being published in the Official Gazette on April 7, 2016,

2.1.2. Personal Data: any kind of information relating to an identified or identifiable natural person,

2.1.3. Data Processor: natural or legal person who processes personal data on behalf of the data controller, based on the authorization given by the data controller,

2.1.4. Data Controller: natural or legal person who determines the purposes and means of processing personal data, and is responsible for the establishment and management of the data recording system,

2.1.5. Processing of personal data: refers to any operation performed on data, whether by automated means or not, including collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, taking over, making available, classification, or prevention of the use of data.

1. Principles of Processing Personal Data 3.1. Personal data belonging to the data subject specified in Article 4 of the PDPL will be processed by the Company, as the data controller, within the scope of the purposes specified below, in compliance with the law and the principles of honesty, accuracy, necessity, relevancy with the purpose for which they are processed, limited to the purpose, and for the duration prescribed by the relevant legislation.
2. Purpose of Processing Your Personal Data 4.1. Our Company’s policy on the Protection, Processing, and Confidentiality of Personal Data has been prepared in accordance with the Law No. 6698 PDPL and the regulations published within the framework of this law. Within this framework, your personal data may be collected by our Companies through various methods such as automatic or non-automatic methods, offices, branches, dealerships, call centers, websites, social media channels, mobile applications, and similar tools verbally, in writing, or electronically. As long as you benefit from the products and services of our Companies, your personal data may be processed by creating and updating them.

4.2. Your personal data may be processed by our Companies and related Companies/organizations, as well as other natural and/or legal persons specified in Article (7.) below, within the scope of the purposes and conditions for personal data processing specified in Articles 5 and 6 of Law No. 6698 PDPL, including but not limited to:

• Carrying out necessary studies by our business units to benefit you from the products and services offered by our Company,
• Recommending products and services offered by our Company,
• Planning and/or executing market research activities for the sale and marketing of products and services,
• Planning and/or executing after-sales support service activities,
• Offering various rewards, earning points, and granting lottery rights within the scope of campaigns you participate in,
• Conducting profiling and analysis activities, customizing and recommending products and services according to your preferences, usage habits, and needs,
• Contacting you through your contact information for all services and products offered by the Company, with your permission, and sending commercial electronic messages for promotional and marketing purposes via telephone, SMS (short message), e-mail, and digital channels,
• Sharing online or offline digital content,
• Providing your personal data as visitors to our stores and shopping centers (this may also include activity information obtained through Wi-Fi tracking),
• Tracking contractual processes and/or legal demands, ensuring the legal, technical, and commercial security of relevant individuals within the business relationship,
• Ensuring the implementation of our Company’s human resources policies, evaluating your job applications, fulfilling our legal and statutory obligations in case you become our employee,
• Ensuring quality control,
• Tracking the supplied products,
• Identifying security and your identity when you visit our business,
• Contacting you when requesting information from our Company,
• Performance of this contract when you purchase products,
• Planning, auditing, and executing information security processes,
• Establishing and managing information technology infrastructure,
• Tracking financial and/or accounting affairs,
• Tracking legal affairs,
• Planning and executing business activities,
• Planning and executing corporate communication activities,
• Determining and implementing the commercial and business strategies of our Company.

1. Cases Where Our Companies Can Process Your Personal Data Without Your Explicit Consent as Required by Law: According to Article 5 of Law No. 6698 PDPL; in the following cases, our Company may process your personal data without your explicit consent in accordance with the law:

• In cases clearly envisaged in laws,
• When it is mandatory for the protection of life or physical integrity, or those of someone else, and the data subject is unable to disclose his/her consent due to actual impossibility or legal invalidity,
• Directly related to the establishment or performance of a contract concluded by our Companies and related Companies/organizations, provided that it is necessary,
• If it is mandatory for our Company to fulfill its legal obligation,
• If your personal data has been disclosed by yourself,
• If data processing is mandatory for the establishment, use, or protection of a right,
• Processing is mandatory for the legitimate interests pursued by our Companies, provided that it does not harm your fundamental rights and freedoms.

6. Processing of Special Category Data:

In Article 6 of Law No. 6698 on the Protection of Personal Data, certain personal data that poses a risk of causing harm or discrimination to individuals when processed unlawfully is defined as “special category” data. These data include race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs; appearance, association, foundation or union membership, health, sexual life, criminal conviction, and data related to security measures, as well as biometric and genetic data. Our companies act in compliance with the regulations stipulated in Article 6 of the Law on the Protection of Personal Data regarding the processing of special category personal data and handle these data with sensitivity in their protection.

Our companies process special category personal data under the following conditions in accordance with the Law on the Protection of Personal Data, provided that adequate measures determined by the Personal Data Protection Board are taken:

⦁ If the data subject gives explicit consent;

Our companies, by sharing the conditions they are in with our companies, can request personalized services and share their special category data for this purpose. In order for our companies to provide personalized services to our business partners based on their identified needs by sharing special category data, and to be able to remember these needs in the future and provide the same services again, our companies will process the special category data of individuals only with the explicit consent of the relevant person and only for the purpose of serving the collection.

⦁ If there is no explicit consent of the data subject;

• Special category personal data other than the health and sexual life of the data subject are processed in cases foreseen in the laws,
• Special category personal data regarding the health and sexual life of the data subject are processed only by persons or authorized institutions and organizations under confidentiality obligation for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, planning and management of health services and financing.

1. Transfer of Personal Data 

7.1. Your personal data may be transferred to our business partners, suppliers, shareholders, affiliates, legally authorized public institutions and private individuals within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698, in order to carry out the necessary studies by our business units to benefit you from the products and services offered by our company; to customize the products and services offered by our company according to your and your company’s needs; to ensure the implementation of our company’s human resources policies; to ensure the legal and commercial security of our company and the individuals within the company’s business relationship; and to determine and implement our company’s commercial and business strategies.

7.2. As our company changes and grows, it may be restructured, acquire new companies, transfer our companies, transfer all or part of its assets, merge with new companies, or experience divisions within our company. As a result of such changes in the company structure, the personal data assets of our company, including the personal data of you as our customers, may also be transferred. In case of such changes, your personal data, including personal data, will be informed through e-mail, letter, or public announcements in terms of the control of personal data belonging to you in accordance with Article 10 of the Law on the Protection of Personal Data, and your explicit consent will be obtained if necessary.

7.3. Our company has the authority to transfer personal data abroad in accordance with the conditions determined by the Personal Data Protection Board in the Law on the Protection of Personal Data and after obtaining the explicit consent of the individual for this purpose.

1. Method of Collection and Legal Basis of Personal Data

 Personal data are collected, used, recorded, stored, and processed verbally, in writing, and/or electronically by our company by clearly and understandably informing the data subjects and obtaining their explicit consent, when necessary, in compliance with the law and honesty, within the scope of the legitimate purposes explicitly stated above, and within the framework of the principle of proportionality. In addition; Your personal data collected through different channels and based on different legal grounds within the commercial purpose of our company, such as contacting us, establishing a contractual relationship, visiting our business, or providing your information for contacting us for commercial activities; is collected in order to develop and conduct the products and services we offer and to conduct our commercial activities. Personal data collected for this legal reason may also be processed and transferred within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698, and the purposes stated in this Disclosure Text.

Storage and Deletion of Data: Our company keeps the processed personal data for the periods determined by the legislation, and if there is no specific period specified in the legislation; personal data are stored for the period required by the practices of our company’s applications and commercial life, which necessitates the processing of that data together with the services provided by our company, and for the periods required for evidence in possible legal disputes after this period. After the end of the specified periods, the personal data in question are deleted, destroyed, or anonymized.

1. Rights of the Data Subject under the Law on the Protection of Personal Data:

10.1. Data subjects have the right to apply to the Company acting as the data controller and request the following regarding themselves;

10.1.1. To learn whether their personal data is processed or not,

10.1.2. If their personal data is processed, to request information regarding this, 

10.1.3. To learn the purpose of processing their personal data and whether this data is used for its purpose, 

10.1.4. To be informed about the third parties to whom their personal data is transferred domestically or abroad, 

10.1.5. If their personal data is incomplete or incorrectly processed, to request the correction of this data, 

10.1.6. To request the deletion or destruction of their personal data within the framework of the conditions specified in Article 7 of the Law No. 6698 on the Protection of Personal Data, 

10.1.7. To request notification of the operations carried out pursuant to Articles (d) and (e) of Article 11 of the Law No. 6698 on the Protection of Personal Data to third parties to whom their personal data is transferred, 10.1.8. To object to the occurrence of a result against themselves by analyzing the processed data exclusively through automated systems, 

10.1.9. If personal data is processed unlawfully, to demand compensation for the damage suffered. However, individuals do not have rights over anonymized data within the companies. Our companies may share personal data with relevant institutions and organizations by sharing their personal data within the framework of the business and contractual relationship for the purpose of using a judicial duty or exercising the legal authorities of the state authority.

1. How to Make a Request under the Law on the Protection of Personal Data: 

11.1. In accordance with Article 13 of the Law on the Protection of Personal Data, you can submit your requests regarding the use of your rights mentioned above to our companies by the methods determined by the Law on the Protection of Personal Data and the relevant legislation, or by using the method(s) to be determined by the Personal Data Protection Board, as specified in the “Procedure for Preliminary Application of Data Subject to Data Controller in accordance with Article 11 of Law No. 6698 KVKK” on our website at the addresses specified in the said text. 

11.2. In order to use your rights mentioned above, you can send your written request, which includes the necessary information identifying your identity and explanations regarding the right you want to use, to BURADA (i) by hand to Istiklal Mh. Yunuseli Blv. O Blok No:13/1 Osmangazi/BURSA, (ii) to the same address by notary or other methods specified by the Law on the Protection of Personal Data, or (iii) to atisholding@hs01.kep.tr address. through the methods specified in the said text. 

11.3. In applications, it is mandatory to include the name, surname, and if the application is in writing, signature, Republic of Turkey identity number for Turkish citizens, nationality for foreigners, passport number/identity number, settlement or workplace address for notification, if any, the e-mail address for notification, phone or fax number, and the subject of the request. 

11.4. In the application, which you will make as the data subject and which includes your explanations regarding the right you want to use and your explanations regarding the right you want to use, it is necessary that the requested issue is clear and understandable, the requested issue is related to yourself, or if you act on behalf of someone else, you must be specifically authorized in this regard and document your authority, the application must contain identity and address information, and documents proving your identity must be attached to the application. Even if data deletion requests are fulfilled, we would like to inform you that we are obliged to share the information with official authorities if requested. 

11.5. In this context, your applications will be concluded within a maximum of 30 days free of charge. However, if an additional cost is envisaged for the transaction, the fee specified in the tariff determined by the Personal Data Protection Board may be requested from you by the Company. 

11.6. Our companies reserve the right to update this “Disclosure Text and Explicit Consent Statement within the Framework of the Law on the Protection of Personal Data” at any time in accordance with the changes that may be made in the official legislation.

 

COOKIE DISCLOSURE TEXT AND PRIVACY POLICY

COOKIE NOTICE AND PRIVACY POLICY

As Atış Holding Inc.  (“Atış Holding” or “Company”), we would like to inform you about the types of cookies used, the purposes of using cookies, and the settings, management, and deletion of these cookies on our websites and all our online and offline platforms (“Platform”) used to enhance your experience during your visit.

The use of cookies mentioned above is managed in accordance with the relevant legislation, especially the Law No. 6698 on the Protection of Personal Data (“KVKK”).

The purpose of this Cookie Notice is to inform you about the cookies used on the Platforms. In this text, we will explain which types of cookies are used for what purposes and how these cookies can be managed in terms of the processing of personal data obtained through the placement of cookies on your device.

As a Company, we reserve the right to discontinue the use of cookies currently used by us on our platforms, change the types or functions of cookies, or add new cookies to our Platforms. Therefore, we reserve the right to change the provisions of this Cookie Notice at any time.

 

 

WHAT ARE COOKIES? 

Cookies are small data files that allow a series of data to be collected and stored on your desktop computer, laptop, or mobile device while visiting our website. The Company may use “cookies” to collect information such as the specific site areas you visit and the services you benefit from on our website. We collect this information to be able to modify our website and the products you are interested in and need. These “cookies” can also be used to help you perform your transactions faster when you revisit our website. For example, our website can recognize the personal data you provide to avoid asking you the same information again. Many web browsers are pre-set to accept a “cookie.” You can adjust your own web browser to reject “cookies” or to be notified when a “cookie” is sent. Rejecting “cookies” on the site you entered may prevent you from navigating some areas of the site or prevent personalized information from being obtained when you visit the site again. We can measure the effectiveness of the existence of our website by determining when you entered our website, which pages you browsed, and how long you stayed. Site measurement statistics can be used to create and evaluate statistics about the use of our website, as well as to personalize your website experience and measure and improve the use of our website in a nameless and aggregate manner.

TYPES OF COOKIES AND PURPOSES OF USE 

1-Types of cookies according to the duration of use: Our website uses session cookies and persistent cookies according to usage periods. Session cookies are used to ensure the continuity of the session and are deleted when the user closes the browser. Persistent cookies are not deleted when the internet browser is closed and are automatically deleted at a certain date or after a certain period.

1.1-First-party and third-party cookies: First-party cookies are placed by the website visited directly by the user, i.e., the internet address shown in the browser’s address bar (example.com.tr). Third-party cookies are placed by a different domain from the domain visited by the user.

2-Types of cookies according to the purposes of use: There are four groups of cookies: Mandatory cookies, Functional cookies, Advertising/Marketing cookies, and Performance/Analytical cookies.

2.1-Mandatory Cookies; These are cookies that are necessary for the proper functioning of our Platforms. They are first-party cookies that store personal data during the session and delete all data when the session ends. These cookies are used for security and authentication purposes and are not used for any marketing purposes.

2.2-Functional Cookies; They enable our Platforms to be used more easily. It allows the next visit of the visitor, for example; to remember language preference or text font size selection. If you do not allow functional identification cookies, some or all of these services may not work properly.

2.3-Advertising/Marketing Cookies; These cookies are third-party cookies. They are used to promote products and services to you, to show you relevant and personalized advertisements together with our partners, and to measure the effectiveness of advertising campaigns. These cookies do not store direct personal information but allow the identification of your browser and internet device.

2.4-Cookies Necessary for Performance and Analysis; These cookies help count the number of visitors to our Platforms to improve our Platforms and increase our performance. These cookies help us understand which pages on our website are the most popular and which ones are the least popular. They are used to improve user experience and do not contain personal data. You can access the cookies used on the Platform from the “Cookie Settings” panel.

METHOD OF COLLECTING PERSONAL DATA AND TO WHOM AND FOR WHAT PURPOSES IT CAN BE TRANSFERRED 

Your collected personal data may be processed within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK, as well as for the purposes specified in this Cookie Notice. As a Company, we may share your personal data covered by this Cookie Notice with our suppliers, legally authorized public institutions, and private individuals in accordance with the law and limited to the realization of the purposes mentioned above.

Purposes of Processing Personal Data and Legal Reasons During the use of Mandatory Cookies 

The personal data processing activities we carry out are based on the necessity of processing personal data of the parties to the contract, within the scope of Article 5, paragraph 2, subparagraphs (c) and (f) of the Law, “Processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract” or “It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, to be processed for the purpose of fulfilling a request for an information society service (logging in, filling out forms and remembering privacy preferences, counting visitors to our website and measuring traffic). Through Performance and Analytical Cookies, the personal data processing activities we carry out are based on explicit consent in the scope of Article 5, paragraph 1 of the Law, for the purpose of counting visitors to our website and measuring traffic, measuring and improving the performance of our website, and understanding which pages on our website are popular, within the scope of the condition of explicit consent, and for the purpose of creating and evaluating statistics regarding the use of our website in a nameless and aggregate manner. The personal data processed through Advertising/Marketing Cookies is processed for the purpose of creating a profile of your interests and showing you relevant advertisements on other websites, within the scope of the condition of explicit consent in Article 5, paragraph 1 of the Law. Personal data processed through Functional Cookies is processed for the purpose of ensuring the personalization and preferences of the website are remembered when you re-enter the site, within the scope of the condition of explicit consent in Article 5, paragraph 1 of the Law.

YOUR RIGHTS ACCORDING TO ARTICLE 11 OF THE KVKK REGULATING THE RIGHTS OF THE DATA SUBJECT 

Learning whether personal data is processed, Requesting information if personal data has been processed, Learning the purpose of processing personal data and whether they are used in accordance with their purpose, Knowing the third parties to whom personal data is transferred, domestically or abroad, Requesting correction of personal data if it is incomplete or incorrectly processed, Requesting deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law, Requesting notification of the operations carried out in this context to third parties to whom personal data is transferred, Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems, Requesting the compensation of the damage in case of damage due to the illegal processing of personal data. In this context, the requests conveyed will be concluded by Atış Holding Inc. within thirty days at the latest free of charge. However, if there is a fee for the transaction, the fee specified in the tariff determined by the Personal Data Protection Board may be requested from you by the Company.

REQUESTS OF DATA SUBJECTS AND RIGHT TO APPLY 

Pursuant to Article 13, paragraph 1 of the KVK Law, you can submit your request regarding the exercise of the rights mentioned above to our Companies through the methods determined by the KVK Law and the relevant legislation or by the methods determined/ to be determined by the Personal Data Protection Board, and following the procedures specified in the “Procedure for Pre-Application to Data Controller in Accordance with Article 11 of Law No. 6698” at the addresses specified in the said text.

It is mandatory to include the name, surname, and if the application is written, the signature, the Republic of Turkey ID number for Turkish citizens, the nationality, passport number/ID number for foreigners, the address for notification or workplace, if any, the email address for notification, telephone, or fax number and the subject of the request in the applications.