Contact Form Privacy Notice

1. Purpose of Processing Personal Data

Personal data within your identity and communication category may be processed for the purpose of conducting customer service activities to receive information, suggestions, and complaints, and responding to these requests, ensuring smooth utilization of the services provided by our Company, and for the improvement of our product and service diversity, by preparing and presenting various reports, analyses, and studies, provided that it does not harm your fundamental rights and freedoms.

2. Method of Personal Data Collection and Legal Basis

Your personal data collected to enable you to benefit from the customer service provided through the Contact Form section on our website is collected through the digital form you fill out.

The processing of your personal data is based on the legal basis of Article 5/2 (f) of the Law, which necessitates data processing for the legitimate interests of the Company, provided that it does not harm your fundamental rights and freedoms. You are not requested to share any special category of personal data in the relevant contact form. However, if you choose to share special category of personal data upon your request, such data will be processed based on the legal basis of explicit consent as per Article 6 of the Law, in connection with the relevant process.

3. Places Where Processed Personal Data is Transferred and Purpose of Transfer

The purpose of processing personal data aligns with the purpose of data transfer. Our Company may transfer the collected personal data to institutions and organizations with which it collaborates, business partners, and suppliers, as well as anonymized personal data to Hacı Ömer Sabancı Holding A.Ş., group companies for necessary supervision and reporting purposes. Additionally, upon request, personal data may be transferred to official authorities and public authorities, and may be transferred abroad for the purpose of utilizing cloud computing technologies. Our Company acts in accordance with Articles 8 and 9 of the Law during the transfer of your personal data and takes all necessary technical and administrative measures to ensure that your data is adequately protected.

4. Ways to Apply to the Data Controller and Your Rights

In accordance with Article 11 of the Law, you have the right to: a) learn whether your personal data is being processed or not, b) If your personal data is being processed, request information regarding such processing, c) learn the purpose of the processing and whether it is being used in accordance with its purpose, d) learn the recipients to whom your personal data has been transferred domestically or abroad, e) request correction of your personal data if it is incomplete or inaccurate, f) request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the Law, g) request notification of the operations carried out to third parties to whom your personal data has been transferred, pursuant to paragraphs (e) and (f) above, h) object to the occurrence of a result against you by analyzing your personal data exclusively through automated systems, i) demand compensation for damages in case you suffer any damages due to unlawful processing

You can submit your requests for information and application regarding the rights mentioned above to the Data Controller in accordance with the principles and procedures specified in the Regulation on Application Procedures and Principles to the Data Controller. You can send your requests to the address "Küçük Çamlıca Mahallesi, Kısıklı Caddesi, No. 56, Üsküdar/Istanbul/Turkey" or via email to sabancidijital.kvk@sabancidijital.hs03.kep.tr. We will ensure that your requests are appropriately addressed and processed in accordance with the relevant regulations and legal requirements.

Our company will conclude your requests, depending on the nature of the request, as soon as possible and no later than thirty days, with the first request being free of charge. However, in subsequent requests related to the same subject matter or if the processing of the initial request requires additional costs, a fee may be charged. Our company reserves the right to accept or reject the request and may provide an explanation for the rejection in writing.

If the application, conducted following the aforementioned procedure, is rejected, the response is deemed insufficient, or if there is no response within the specified period after the notification of the response, you have the right to lodge a complaint with the Personal Data Protection Board ("Board") within sixty days at the latest from the date of application, following the notification of the response. However, the complaint cannot be lodged before exhausting the application process.

The Board conducts necessary examinations in cases where a complaint is lodged or upon learning of an alleged violation falling within its jurisdiction. Upon receiving a complaint, the Board examines the request and provides a response to the relevant parties. If no response is provided within sixty days from the date of the complaint, the request is considered rejected. Following an examination conducted either upon complaint or ex officio, if the existence of a violation is determined, the Board decides on the measures to be taken by the data controller to remedy the identified breaches of the law and notifies the parties concerned. This decision must be implemented without delay and at the latest within thirty days from the date of notification. In cases where it is evident that irreparable harm may occur or there is a clear violation of the law, the Board may decide to halt the processing of data or the transfer of data abroad.

We would like to express our gratitude for the trust you place in us and assure you that your data is meticulously protected within our company. Thank you for your confidence.