Personal Data Protection Text
Within the framework of
the Law No. 6698 on the Protection of Personal Data
Regarding the Processing of Personal Data, Heni Kozmetik
Kimya Sanayi Tic. Ltd. Sti.
Clarification Text
1. Purpose and Scope of
the Clarification Text
This Statement, Heni Kozmetik Kimya
Sanayi Tic. Ltd. Sti.
(“Heni Kozmetik” or the “Company”) in
accordance with the importance it attaches to personal data; personal data of
our customers, potential customers, employees, employee candidates, company
shareholders, company officials, visitors, employees of the institutions we
cooperate with, shareholders and officials and third parties (shortly “data
subject”) within the scope of the Personal Data Protection Law (“KVKK”). It has
been prepared to reveal the approach of our Company on the protection and
processing of data and to inform the data subject in this direction.
The data included within the scope of
the Clarification Text on the Processing of Personal Data (“Text”) relates to
all personal data of the data subject that is processed automatically or
non-automatically, provided that it is a part of any data recording system.
.
This text issued by our company is dated 07/03/2020. In case the
whole or certain articles of the text are renewed, the effective date and
version of the text will be updated. The text is published on our company's
website www.scentora.com.tr and is made available to the relevant persons upon
the request of the personal data subject.
2. Principles Regarding
Personal Data
a. Processing of Personal Data
·
Our company, in accordance with Article 20 of the Constitution
and Article 4 of the KVKK, In accordance with the law and honesty rules,
·
Accurately
and up-to-date when necessary,
·
Pursuing
specific, clear and legitimate purposes,
·
related
to the purpose
·
in
a limited and measured way,
·
By
keeping it for as long as required by the laws or for the purpose of processing
personal data,
·
Based
on the article of KVKK,
·
is
processed.
·
Our
company, in accordance with Article 20 of the Constitution and Article 10 of
the KVKK,
·
during
its acquisition;
·
For
what purpose personal data will be processed,
·
To
whom and for what purpose the processed personal data can be transferred,
·
Method
and legal reason for personal data collection and
·
It
fulfills its obligation to inform by informing about the rights of the personal
data subject.
·
Legal
Reasons for Processing Personal Data
·
Personal
data is processed by our company for the purposes stated in Article 5 of the
KVKK and listed below;
·
It
is clearly stipulated in the Laws for our Company to carry out relevant
activities regarding the processing of personal data,
·
The
processing of personal data by our Company is directly related to and necessary
for the establishment or performance of a contract,
·
The
processing of personal data is mandatory for our Company to fulfill its legal
obligations,
·
Provided
that personal data is made public; Processed by our Company in a limited way
for the purpose of publicizing,
·
The
processing of personal data by our Company is mandatory for the establishment,
exercise or protection of the rights of our Company or the data subject or
third parties,
·
It
is mandatory to process personal data for the legitimate interests of our
Company, provided that it does not harm the fundamental rights and freedoms of
the data subject,
·
If
the data processing activity is necessary for the protection of the life or
physical integrity of the personal data subject or someone else, and in this
case, the personal data subject is unable to express its consent due to actual
impossibility or legal invalidity.
In Article
6 of the KVKK, a set of personal data that carries the risk of causing
victimization or discrimination when processed unlawfully is determined as
"special quality". These data are; Data related to race, ethnicity,
political thought, philosophical belief, religion, sect or other beliefs,
clothing, association, foundation or union membership, health, sexual life,
criminal conviction and security measures, and biometric and genetic data. By
our company; Special categories of personal data are processed in the following
cases, provided that adequate measures to be determined by the Personal Data
Protection Board (“Board”) are taken:
Special categories of personal data other than the
health and sexual life of the personal data subject, in cases stipulated by the
laws,
Private personal data related to the health and sexual
life of the personal data subject is only for the purposes of protecting public
health, performing preventive medicine, medical diagnosis, treatment and care
services, planning and managing health services and financing, or persons or
authorized institutions and organizations that are under the obligation of
confidentiality. by,
It is processed. In the absence of the above-mentioned
data processing conditions, express consent is obtained from the data subject
for data processing by our Company.
b. Transfer of Personal Data
Our company will be able to transfer the personal data
specified in the same section for the purposes specified in section 2.b of this
text, for the purposes stated below;
Legally Authorized public institutions and
organizations, limited to the purpose requested by the relevant public
institutions and organizations within their legal authority.
Personal data will be transferred to legally
authorized private legal persons, limited to the purpose requested by the
relevant private legal persons within their legal authority.
Again, your personal data may be transferred abroad
within the framework of the execution of our Company's commercial activities
and operational activities, within the conditions specified in Article 9 of the
Law.
c. Purpose of Personal Data Collection
Your personal data in
accordance with the above-mentioned purposes; It is collected in order to
provide and develop the products and services we offer and to carry out our
commercial activities. Your personal data collected in this process; It is
collected for the purpose of carrying out our commercial activities, through
our employees and representatives or through public databases within the scope
of the relevant legislation, through business cards collected, through e-mails
sent to our company's e-mail address with the "info" extension.
Provided that your personal data collected for this purpose does not harm your
fundamental rights and freedoms, for the legitimate interests of Heni Kozmetik,
within the scope of subparagraph (f) of paragraph 2 of Article 5 of the Law No.
6698, as specified in articles (b) and (c) of this Information Text. It can
also be processed and transferred for other purposes.
Personal data is processed by
our Company within the scope of the above-mentioned conditions, in accordance
with the provision of services by our Company and in accordance with the local
legislation, for the purposes stated below.
In line with the aim of ensuring the execution of our company's
human resources policies;
Execution of HR operations in
accordance with the HR policies of the Company, recruitment of suitable
personnel for open positions in accordance with the HR policies of the Company,
fulfillment of obligations within the framework of occupational health and
safety and taking necessary measures
In line with the fulfillment of
legal and commercial obligations with our company and the people who have
business relations with our company; Administrative operations for
communication, operations for service carried out by our company, ensuring the
physical security and supervision of the company's locations, business
partner/customer/supplier/business partner (authorized or employees or
partners) evaluation processes, legal and commercial risk analysis, legal
compliance process, conducting financial affairs
In line with the aim of
carrying out the necessary studies in order to recommend the products and
services offered by our company to our customers by customizing them according
to the tastes, usage habits and needs of our customers; One-to-one and/or
integrated marketing activities, sales and after-sales operations carried out
by our company,
In line with the purpose of
determining and implementing our company's commercial and business strategies;
Financial operations, communication, market research and social responsibility
activities carried out by our company, purchasing operations (demand, offer,
evaluation, order, budgeting, contract), determination and implementation of
our company's commercial and business strategies,
In-house system and application
management operations can be listed as the management of legal operations.
The personal data processed by our company within the scope of
this Text are classified categorically in KSV1_LIST and specified in KSV2_LIST.
D. Storage and Deletion of Data
Our company stores the personal
data it processes for the periods determined by the legislation, and in the
absence of a separate period specified in the legislation; Personal data is
stored for the period that requires processing in accordance with the practices
of our Company and the practices of commercial life, depending on the services
our company provides while processing that data, and after this period, only
for the periods that are necessary in practice in order to constitute evidence
in possible legal disputes. After the expiry of the specified periods, the
personal data in question are deleted, destroyed or anonymized.
3. Rights of the Relevant
Person
Article 20 of the Constitution
stipulates that everyone has the right to be informed about the personal data
related to him/her, and Article 11 of the KVKK includes the right to
"request information" among the rights of the personal data subject.
In this context, our company provides the necessary information in case the
personal data subject requests information; With this Statement, our Company
informs the person concerned about how the right to request information will be
exercised and how the issues related to the information request will be
evaluated.
The personal data subject has
the following rights:
Learning whether personal data is
processed or not,
·
If
personal data has been processed, requesting information about it,
·
Learning
the purpose of processing personal data and whether they are used in accordance
with its purpose,
·
Knowing
the third parties to whom personal data is transferred at home or abroad,
·
Requesting
correction of personal data in case of incomplete or incorrect processing and
requesting notification of the transaction made within this scope to the third
parties to whom the personal data has been transferred,
·
Requesting
the deletion or destruction of personal data in the event that the reasons
requiring its processing have disappeared, although it has been processed in
accordance with the provisions of the KVKK and other relevant laws, and
requesting the notification of the transaction made within this scope to the
third parties to whom the personal data has been transferred,
·
Objecting
to the emergence of a result against the person himself by analyzing the
processed data exclusively through automated systems,
·
In
case of loss due to unlawful processing of personal data, requesting the
compensation of the damage
·
Pursuant
to Article 28 of KVKK, the following cases are excluded from the scope of KVKK;
The personal data subject cannot claim the above-mentioned rights in these
matters:
·
Processing
personal data for purposes such as research, planning and statistics by making
it anonymous with official statistics.
·
Processing
of personal data for art, history, literature or scientific purposes or within
the scope of freedom of expression, provided that it does not violate national
defense, national security, public security, public order, economic security,
privacy of private life or personal rights or does not constitute a crime.
·
Processing
of personal data within the scope of preventive, protective and intelligence
activities carried out by public institutions and organizations authorized by
law to ensure national defense, national security, public security, public
order or economic security.
·
Processing
of personal data by judicial authorities or execution authorities in relation
to investigation, prosecution, trial or execution proceedings.
·
Pursuant
to Article 28/2 of the KVKK, the personal data subject cannot claim the
above-mentioned rights in these matters, except for the right to demand the
compensation of the damage, in the following cases:
·
The
processing of personal data is necessary for the prevention of crime or for
criminal investigation.
·
Processing of personal data made public by the personal data
subject.
·
Personal
data processing is required by the authorized and authorized public
institutions and organizations and professional organizations in the nature of
public institutions for the execution of supervisory or regulation duties and
for disciplinary investigation or prosecution based on the authority granted by
the law.
· Economic and financial issues of the
State regarding the budget, tax and financial matters of personal data
processing.
· Necessary for the protection of their
interests.
· The personal data subject can submit
their requests regarding their rights mentioned above to our Company by filling
out the form at www.scentora.com.tr through the ways specified in the
application form. In order for a person other than the personal data subject to
make a request, there must be a special power of attorney issued by the
personal data subject on behalf of the person making the application.
· The duly submitted requests to our
company will be finalized within thirty days at the latest. In the event that
the conclusion of the aforementioned requests requires an additional cost, the
fee in the tariff determined by the Board will be collected from the applicant
by our Company.
· Our company may request information
from the relevant person in order to determine whether the applicant is a
personal data subject, and may ask questions about the application to the
personal data subject in order to clarify the issues stated in the application.
Our company may reject the application of the applicant in the following cases
by explaining the reason:
· Processing personal data for purposes
such as research, planning and statistics by making it anonymous with official
statistics.
· Processing of personal data for art,
history, literature or scientific purposes or within the scope of freedom of
expression, provided that it does not violate national defense, national
security, public security, public order, economic security, privacy of private
life or personal rights or does not constitute a crime.
· Processing of personal data within
the scope of preventive, protective and intelligence activities carried out by
public institutions and organizations authorized by law to ensure national
defense, national security, public safety, public order or economic security.
· Processing of personal data by
judicial authorities or execution authorities in relation to investigation,
prosecution, trial or execution proceedings. The processing of personal data is
necessary for the prevention of crime or for criminal investigation.
· Processing of personal data made
public by the personal data subject.
· Personal data processing is required
by the authorized and authorized public institutions and organizations and
professional organizations in the nature of public institutions for the
execution of supervisory or regulation duties and for disciplinary
investigation or prosecution based on the authority granted by the law.
· The processing of personal data is
necessary for the protection of the economic and financial interests of the
State with regard to budgetary, tax and financial matters.
· The possibility of the personal data
subject's request to prevent the rights and freedoms of other persons.
· Making demands that require
disproportionate effort
· The requested information is publicly
available.
· In case the application is rejected
in accordance with Article 14 of the KVKK, the answer given is insufficient or
the application is not answered in due time; Complaints may be made to the
Board within thirty days from the date our company learns of the answer, and
possibly within sixty days from the date of application.
· 4. Security of Personal Data
· a. Security precautions
· In accordance with Article 12 of the
KVKK, our company takes the necessary precautions and controls to ensure the
appropriate level of security in order to prevent the unlawful processing of
the personal data it processes, to prevent the illegal access to the data and
to ensure the preservation of the data, and in this context, it carries out or
has the necessary inspections made. In this regard, the measures and controls
taken by our Company are given below:
· Employing personnel who are
knowledgeable about establishing and operating systems that comply with the
principles and relevant legislation regarding the processing of personal data,
· Providing trainings to ensure that
personnel are informed about personal data, including provisions regarding
compliance with personal data protection legislation and Company practice rules
in personnel contracts
· Using backup programs in accordance
with the legislation that ensure the safe storage of personal data,
· If a service covering personal data
processing processes is outsourced, it should be included in the contracts made
with outsourcing companies that the necessary security measures will be taken
to protect personal data and that these measures will be complied with in their
own organizations,
· Evaluating the personal data
processing processes involved in all activities carried out by our company
within the scope of the data processing conditions regulated by the KVKK,
taking the necessary technical and organizational measures to maintain the said
processes in accordance with the provisions of the KVKK,
· Determining and implementing the
rules of practice regarding the management of personal data processing processes
and compliance structure, including measures and controls
·
Maintaining
and auditing personal data processing processes and systems related to these
processes with management systems with technical and organizational features,
b. Audit
In accordance with Article 12
of the KVK Law, our company carries out or has had the necessary inspections
made within its own body. The results of these audits are reported to the
relevant department within the scope of the internal operation of the Company
and necessary activities are carried out to improve the measures taken.
Necessary systems are
established and necessary trainings are provided to the existing employees of
the Company's business units and employees who have just joined the business
unit to raise awareness about the protection of personal data.
c. Data Breach Management
Our company operates the system
that ensures that the personal data processed in accordance with Article 12 of
the KVKK are obtained by others illegally, and this situation is reported to
the relevant personal data subject and the Board as soon as possible. If deemed
necessary by the Board, this may be announced on the Board's website or by any
other method.
Title:Heni Kozmetik Kimya Sanayi Tic. Ltd. Sti.
MersisNo:0461103139500001
Phone number: ***********
Postal Address: Pınartepe Mahallesi Mayıs
Sokak No: 7 D:26
Buyukcekmece / ISTANBUL
E-mail address: info@scentora.com.tr