PDPL Clarification Text for Customers

CUSTOMER CLARIFICATION TEXT ON THE ACQUISITION, PROCESSING AND PROTECTION OF PERSONAL DATA

1- GENERAL DESCRIPTION AND DEFINITIONS
This text has been prepared in order to fulfill the "clarification obligation" of ICT Bulut Bilişim A.Ş. (hereinafter referred to as Bulutistan) as the "data controller" within the scope of Article 10 of the Personal Data Protection Law No. 6698 (PDPL).
The meanings of the following terms in the information text refer to the definitions specified in the Law No. 6698, the Regulations and Communiqués issued in relation to this Law and are as follows.
- Personal data: Any information relating to an identified or identifiable natural person,
- Processing of personal data: Any operation performed on personal data such as obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system,
- Relevant person: The natural person whose personal data is processed,
- Explicit consent: Consent on a specific issue, based on information and expressed with free will,
- Anonymization: Making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data,
- Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,
- Data processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller,
- Data recording system: A recording system in which personal data is structured and processed according to certain criteria,
- Contact person: The real person notified by the data controller at the time of registration to the Registry for the communication to be established with the Authority regarding the obligations of the legal entities resident in Turkey and the non-resident legal entity data controller representative within the scope of the Law and the secondary regulations to be issued based on this Law,
- Personal data retention and destruction policy: The policy on which data controllers base the process of determining the maximum period of time necessary for the purpose for which personal data are processed and the process of deletion, destruction and anonymization. 

2- INFORMATION ON THE DATA CONTROLLER
Data Controller’s:

3- PERSONAL DATA TO BE PROCESSED
The personal data to be processed by BULUTISTAN are specified below and new ones may be added and/or changes may be made to this information within the scope of the legal legislation when required and/or required by law.
Personal data subject to data processing, the relevant person;
- Identity information, residence information, contact information, financial information, tax information, bank account information,
- Entry and exit information, correspondence,
- Camera[ea1] recording system images.

4- PURPOSE OF PROCESSING PERSONAL DATA
BULUTiSTAN processes personal data for the following purposes. These purposes are
- Making sales, determining financing terms, making collections,
- Ensuring after-sales support and customer satisfaction, finalizing complaints, ensuring communication,
- Notification of discounts and campaigns,
- Fulfillment of legal obligations, particularly the Turkish Commercial Code, Turkish Code of Obligations and Tax Law,
- Ensuring the safety of property and life within the company, intervening in emergencies, increasing productivity. 

5- TRANSFER OF PERSONAL DATA AND PURPOSE OF TRANSFER
BULUTİSTAN may transfer the personal data obtained in line with the purposes of data processing to the persons, institutions and / or organizations required / permitted by the provisions of the PDPL and other legislation, including, but not limited to, BULUTİSTAN's domestic / foreign affiliates, cooperating program partner / solution partner institutions and organizations, reconciliation firm, consultancy and independent audit service companies, due to legal obligations; Even if there is no legal obligation, it may transfer personal data to third parties and institutions in order to realize the purposes within the scope of Article 4, provided that the rights of the person concerned under the PDPL are reserved. 

6- METHODS AND LEGAL REASON FOR ACQUISITION OF PERSONAL DATA
Personal data may be obtained directly from the data subject verbally, by hand and/or electronic mail, social media, written form and camera recording systems for the purposes stated above based on Articles 5 and 6 of the PDPL.

7- RIGHTS OF THE PERSON CONCERNED
Relevant persons may apply to the data controller to
- To learn whether personal data is processed or not,
- Request information if their personal data has been processed,
- To learn the purpose of processing personal data and whether they are used for their intended purpose,
- To know the third parties to whom personal data are transferred domestically or abroad,
- To request correction of personal data in case of incomplete or incorrect processing,
- To request the deletion or destruction of personal data within the framework of the conditions stipulated in the law,
- To request notification of changes regarding the correction, deletion or destruction of personal data to third parties to whom personal data are transferred,
- To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,
- In case of damage due to unlawful processing of personal data, it has the right to demand compensation for the damage.