- Introduction
- Definitions
- Policy Effectiveness
- Data Controller
- Data Regarding the Processing of Personal Data
- Purpose of Processing Personal Data
- Conditions for Transfer of Personal Data
- Personal Data Retention Periods
- Rights of the Data Subject
- Role and Rights of the Data Controller
- Destruction Period of Personal Data
- Policy Amendments
INTRODUCTION
As Fx MATİK, we act with utmost diligence in protecting and processing your personal data to the maximum extent and within the limits prescribed by law, and we carry out all our planning and activities within this framework. With this awareness and responsibility, and within the framework of Article 10 of Law No. 6698 on the Protection of Personal Data, we present this policy to you. Our personal data protection policy is a sustainable and innovative policy that protects the personal data of our users. The fundamental principles of the existing legislation on the confidentiality / protection of personal data have been reviewed and our policy has been prepared in harmony with the legislation. The main purpose of this policy is to provide you, our valued users, with explanations and the necessary information regarding the processing and storage of your personal data in accordance with the law and the relevant legislation. Fx MATİK collects the personal and special categories of personal data of users in order to operate in the sector, to establish a valid contractual relationship, and for situations that must be reported to public institutions and organizations.
DEFINITIONS
Under this Policy, the following terms, highlighted in bold, mean the following:
- EXPLICIT CONSENT means the consent given freely, based on information, regarding a specific subject,
- ANONYMIZATION means making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data,
- DATA SUBJECT means the natural person whose personal data is processed,
- PERSONAL DATA means any information relating to an identified or identifiable natural person,
- PROCESSING OF PERSONAL DATA means any operation performed on data such as obtaining, recording, storing, preserving, modifying, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether wholly or partly automatic or non-automatic provided that it is part of any data recording system,
- BOARD means the Personal Data Protection Board,
- AUTHORITY means the Personal Data Protection Authority,
- DATA PROCESSOR means the natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller,
- DATA RECORDING SYSTEM means the recording system in which personal data is processed by structuring it according to specific criteria,
- DATA CONTROLLER means the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,
- EFFECTIVENESS OF OUR POLICY This policy comes into effect on the date it is published by Fx MATİK. Our policy is published and made available on our company's website at fxmatik.com.tr.
- DATA CONTROLLER The Data Controller is Fx MATİK, and the data controller can be reached at Akıncılar Mah. 3971 Sok. N:10 Yüreğir/ADANA or via the fxmatik.com.tr website.
GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
The personal data stored by Fx MATİK is processed within the limits of the relevant legislation and in accordance with the procedures and principles set forth in this policy. The principles we observe in the processing of personal data are as follows;
- The personal data of our users stored and processed by us is processed within the limits determined by the relevant legislation and in accordance with the rules of good faith,
- The care to be shown regarding the storage and processing of personal data shall not be less than the maximum level,
- The rules of law and good faith shall be upheld at every stage,
- Personal data shall be processed in proportion to the purposes of storage and processing, and the principle of proportionality shall be observed,
- Personal data shall be stored and processed entirely in accordance with the law and for legitimate purposes, and shall be stored entirely in connection with the service provided,
- The stored and processed data shall be within both the limits prescribed by law and the limits of the work carried out by us. In this context, the principles of limitation and proportionality shall be adopted,
- If there is no longer a valid reason for the storage and processing of personal data, the personal data shall be destroyed or anonymized ex officio or upon the request of the data subject, no later than the end of the periods prescribed by law.
- Personal data shall be protected from access by unauthorized persons. It is forbidden for unauthorized persons to process personal data. It is also forbidden for authorized persons to transfer the data processing activity or access to unauthorized persons, and the sensitivity regulated in this policy and in the confidentiality agreements is observed in this regard.
PURPOSE OF PROCESSING PERSONAL DATA
The main purposes of processing your personal data are as follows;
- Ensuring better participation in the services we offer to our users,
- Planning and implementing strategies regarding our operations in the best and most efficient way,
- Ensuring all kinds of legal, technological and commercial security,
- Presenting our products and services to users / personal data owners in the best possible way,
- Taking appropriate steps by considering the requests and needs of personal data owners,
- Resolving errors, deficiencies and malfunctions regarding our products and services as soon as possible,
- Providing information arising from the relevant legislation to official institutions regarding our business and operations,
- Carrying out all promotional and marketing activities
METHOD OF PROTECTION OF PERSONAL DATA
The Data Controller takes appropriate security measures to the maximum extent to prevent unauthorized access to personal data, disclosure, alteration or destruction of data. The analysis and processing of data may also be carried out with the help of third-party companies that cannot use such data on their own. Mailing services (e-mail, cloud usage) may also be carried out with the technical assistance of third-party companies to which addresses may be transmitted, only for these purposes. Data cannot be used for different purposes and cannot be recorded by these third parties except for sending the requested communications. The cloud and server service contracted by the data controller is also one of the methods of protecting personal data.
CONDITIONS FOR THE TRANSFER OF PERSONAL DATA
Personal data is not transferred without the explicit consent of the data subject. Although this is the general rule, transfer may be made without obtaining the explicit consent of the data subject in the following cases:
- If it is expressly stipulated in laws,
- If it is mandatory for the protection of the life or bodily integrity of the person who is unable to express his/her consent due to actual impossibility or whose consent is not granted legal validity, or of another person,
- If the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,
- If it is mandatory for the data controller to fulfill its legal obligation,
- If the personal data has been made public by the data subject himself/herself,
- If data processing is mandatory for the establishment, exercise or protection of a right,
- If data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
DATA RETENTION PERIOD
The personal data of our users is processed and stored for the period required by the purposes of collection, within the scope of Law No. 6698 on the Protection of Personal Data and in accordance with the limitations of the relevant legislation. In any case, the Data Controller will process the Personal Data for the period required to fulfill its contractual and legal obligations. Destruction periods vary according to the subject, the storage conditions or the cases where the given consent is withdrawn. Personal Data collected for purposes related to the legitimate interest of the Data Controller will be stored until that interest is satisfied. The data subject may obtain more information about the legitimate interest pursued by the Data Controller or may contact the Data Controller. In cases where the explicit consent of the data subject is required, the Data Controller may keep the personal data for a longer period until such consent is revoked. In addition, the Data Controller may be required to keep personal data for a longer period in accordance with a legal obligation or an order of an authority. At the end of the retention period, personal data will be deleted. Therefore, at the end of this period, the rights of access, cancellation, correction and data portability can no longer be exercised. The data controller does not intentionally collect personal data regarding children and persons under guardianship. The collection of personal data regarding minors or persons under guardianship with the permission of their legal representative, or in some cases ex officio processing, shall be valid. In cases where explicit consent is a condition, the data controller will delete the personal data in a timely manner if it determines that there is no consent.
RIGHTS OF THE DATA SUBJECT
In case of processing of personal data, the relevant parties should have the opportunity to obtain information on this matter. Article 11 of the KVKK lists the rights of the data subject. Accordingly, the data subjects have the right to,
- Learn whether personal data is being processed,
- If personal data has been processed, request data regarding this,
- Learn the purpose of processing personal data and whether they are used in accordance with this purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request correction of personal data if it has been processed incompletely or incorrectly,
- Request the deletion and destruction of personal data if the processing period has expired,
- Request the compensation of the damage in cases where they suffer damage due to the unlawful processing of their personal data.
ROLE AND RESPONSIBILITIES OF THE DATA CONTROLLER
The data controller is obliged to prevent the unlawful processing of personal data, prevent unlawful access and ensure their preservation. In this context, Fx MATİK will take all necessary administrative and technical measures to protect the personal data of users. In case the data is processed by another real/legal person, joint and several liability is in question.
DESTRUCTION OF PERSONAL DATA
As detailed below, personal data is destroyed within legal limits, upon the request of the data owner or ex officio. Accordingly;
- If the retention period has expired or the obligation has disappeared due to a change in storage conditions caused by legislation,
- If the purpose of processing has disappeared,
- If the conditions requiring the processing of personal data in Articles 5 and 6 of the Law have disappeared,
- If the data subject has withdrawn his/her explicit consent regarding personal data processed with his/her explicit consent,
- If the data controller has rejected the application made by the data subject for the deletion, destruction or anonymization of his/her personal data, if the answer given was found insufficient by the data subject, or if no answer was given within the period stipulated by the Law; with filing a complaint to the Board and with the Board's recommendation,
- If the maximum period requiring the storage of personal data has passed, it is deleted and destroyed.
POLICY AMENDMENTS
The policy arrangement may change. The data subject should regularly check this policy on our website and the current one should be taken as basis. Fx MATİK reserves the right to make changes to this policy due to amendments to the Law, in accordance with the decisions of the Personal Data Protection Board, or in line with developments in the sector or in the field of informatics. Changes made to this Policy are immediately incorporated into the text, and explanations regarding the changes are announced at the end of the Policy and on the fxmatik.com.tr website.