DATA SUBJECT APPLICATION PROCESS FLOWCHART
1. Our Company maintains the necessary channels, internal procedures, administrative, and technical arrangements in accordance with Article 12 of the KVKK to evaluate the rights of personal data subjects and to provide the required information to personal data subjects.
2. If personal data subjects submit their requests regarding the rights listed below to our Company in writing, our Company will finalise the request free of charge as soon as possible and at the latest within thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, the fee outlined in the tariff determined by the Personal Data Protection Board (KVK Board) shall be charged by our Company. Personal data subjects have the following rights:
- To learn whether your personal data is processed by us
- If your personal data has been processed by us, to request information regarding this
- To learn the purpose of processing personal data and whether it is used in accordance with its purpose
- To know the third parties to whom personal data is transferred domestically or abroad
- If personal data is processed incompletely or inaccurately, to request its correction and to request that the actions taken be notified to third parties to whom personal data has been transferred
- Within the framework of the conditions stipulated in Article 7 of the KVKK, to request the deletion or destruction of personal data and to request that the actions taken be notified to third parties to whom personal data has been transferred
- To object to the occurrence of a result against the person by analysing the processed data exclusively through automated systems
- If personal data is processed unlawfully and this results in damage, to request compensation for such damage
3. In this context, it is mandatory for the relevant persons to first submit their requests regarding the implementation of the Law (Art. 11) to the data controller. The Law provides for a tiered application procedure for applications within the scope of personal data protection.
4. For relevant persons to exercise their rights, they must first apply to the data controller. Without exhausting this route, a complaint cannot be filed with the Board.
5. The data controller must respond to the relevant person’s request within 30 days. Relevant persons whose application is rejected, who find the response insufficient, or who do not receive a response within the prescribed time may exercise their right to complain with the Board.
6. In the data subject application form, the application methods are limited to written submission, registered electronic signature, and fax. Applications submitted to the Company through one of these methods are evaluated by the data controller.
7. This right of the data subject is, first and foremost, under constitutional protection, and ultimately, provided that the request has been duly submitted, the data controller must respond to the requests addressed to it lawfully. Therefore, the data controller can’t avoid its obligation to respond.
8. Pursuant to Article 6 of the Communiqué on the Procedures and Principles of Application to the Data Controller, the data controller is obliged to take all necessary administrative and technical measures to finalise applications to be made by the relevant person under this Communiqué effectively and in compliance with the law and the rule of honesty. Accordingly, the data controller either accepts the application or rejects it by explaining the reason. The data controller notifies the relevant person of its response in writing or electronically.
9. The response letter must include;
- Information regarding the data controller or its representative,
- The applicant’s name and surname; Turkish Republic ID number for Republic of Türkiye citizens; nationality for foreigners; passport number or, if any, identity number; residential or business address for notification; if any, e-mail address for notification; telephone and fax number,
- The subject of the request,
- The data controller’s explanations regarding the application must be included.
10. The data controller finalises the requests included in the application free of charge as soon as possible and at the latest within thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, the fee specified in Article 7 may be charged.
11. If the relevant person’s request is accepted, the data controller fulfils the request as soon as possible and informs the relevant person.
12. Our Company operates a system that ensures that, if personal data processed in accordance with Article 12 of the KVKK is obtained by others through unlawful means, this situation is notified to the relevant personal data subject and the KVK Board as soon as possible.