1.1. Purpose of the Policy
Within the scope of Law No. 6698 on the Protection of Personal Data ("Law");As TEKSOY TOURISM HOSPITALITY FOOD INVESTMENT INDUSTRY TRADE INC. (TEKSOY TOURISM), processing personal data in compliance with the law and protecting it are among our top priorities. We follow the same priority in all our planning and business activities. In this context, in accordance with Item10 of the Law, we present this "Policy on Processing and Protection of Personal Data" ("Policy") to inform you and to disclose all administrative and technical measures we will implement regarding the processing and protection of personal data.
This Policy establishes the conditions for the processing of personal data and sets forth the principles adopted by TEKSOY TURİZM in the processing of personal data. In this context, the Policy encompasses all personal data processing activities conducted by TEKSOY TURİZM within the scope of the Law, including all processed personal data and their owners.
1.4. Effectiveness of the Policy
This Policy, organized by TEKSOY TOURISM, has entered into force on .............. date and has been made public. In case of any inconsistency between the regulations in force, especially the Law, and the regulations included in this Policy, the provisions of the legislation will be applied.TEKSOY TOURISM reserves the right to make changes to the Policy in parallel with legal regulations.
2.1. Data Owners
Policy within the scope of data subjects are all individuals, except TEKSOY TURİZM employees, whose personal data is processed by TEKSOY TURİZM. In general, data subjects can be listed as follows:
The data subject categories described in the table above are indicated for general information sharing purposes. The fact that the data subject does not fall within the scope of any of these categories does not eliminate the data subject's status as specified in the Law.
2.2. Purposes of Processing Personal Data
2.2.1. Conducting necessary activities by relevant units to benefit individuals from the products and services offered by TEKSOY TOURISM and carrying out business processes:
2.2.2. Planning and executing human resources policies and processes of TEKSOY TOURISM:
2.2.3. Carrying out the necessary studies by relevant business units for the realization of commercial activities conducted by TEKSOY TOURISM and the execution of related business processes:
2.2.4. Planning and executing activities necessary for the customization, recommendation, and promotion of products and services offered by TEKSOY TOURISM according to the preferences, usage habits, and needs of the relevant individuals:
2.2.5. Planning and executing commercial and/or business strategies of TEKSOY TOURISM:
Managing relationships with business partners.
2.2.6. Ensuring legal, technical, and commercial business security of TEKSOY TOURISM and individuals in business relationship with TEKSOY TOURISM:
2.3.Personal Data Categories
The following categories of personal data categorized by TEKSOY TOURISM are processed in compliance with the conditions for processing personal data stipulated in the Law and related legislation:
3. Principles and Conditions for Processing Personal Data
TEKSOY TURİZM processes personal data in accordance with Article 4 of the Law, acting in compliance with the law and principles of honesty, ensuring that the data is accurate, up-to-date when necessary, specific, clear, and processed for legitimate purposes. The processing activities are limited, proportionate, and related to the specified purposes. TEKSOY TURİZM retains personal data for the duration specified by the laws or as long as necessary for the purpose of processing personal data.
3.1. Principles for Processing Personal Data
TEKSOY TOURISM informs data owners in accordance with Item 10 of the Law and, when consent is required, requests their consent, processing these personal data based on the principles stated below.
3.1.1. Processing Data in Compliance with the Law and Fairness
TEKSOY TOURISM acts in accordance with the principles established by legal regulations and the general trust and fairness rule in the processing of personal data. In accordance with the principle of fairness, TEKSOY TOURISM strives to achieve its data processing goals while taking into account the interests and reasonable expectations of the relevant individuals.
3.1.2. Ensuring the Accuracy and Timeliness of Personal Data
Ensuring that personal data is kept accurate and up-to-date is necessary for the protection of the fundamental rights and freedoms of the data subjects from TEKSOY TOURISM's perspective. In this regard, TEKSOY TOURISM has an active duty of care to keep the information of the data subject accurate and up-to-date, and all communication channels are open for this purpose.
3.1.3. Processing Data for Specified, Explicit, and Legitimate Purposes
TEKSOY TOURISM clearly and precisely determines the legitimate and legal purpose of processing personal data. It processes only the personal data necessary for the purposes that are directly related to its commercial activities and necessary for the conduct of its business.
3.1.4. Connection, Limitation, and Proportionality of Data Processing with the Purpose
TEKSOY TOURISM processes personal data within the purposes suitable for its business subject and necessary for the conduct of its business. Therefore, TEKSOY TOURISM processes personal data in a way that is conducive to achieving the defined purposes and avoids processing personal data that is not related to the realization of the purpose or is unnecessary.
3.1.5. Retention of Data Until the Period Prescribed in the Relevant Legislation or Required for the Purpose for Which They Were Processed
TEKSOY TOURISM retains personal data only for the period prescribed in the relevant legislation or required for the purpose for which they were processed. In this context, TEKSOY TOURISM first determines whether there is a specified period for storing personal data in the relevant legislation. If a period is determined, it acts in accordance with this period; if no period is specified, it keeps personal data for the duration necessary for the purpose of processing. After the purpose of personal data processing has ceased or upon the expiration of the period specified in the legislation, personal data is deleted, destroyed, or anonymized by TEKSOY TOURISM.
3.2. Conditions for Processing Personal Data
In accordance with Item 5 of the Law, personal data processing is carried out by TEKSOY TOURISM if at least one of the personal data processing conditions specified in Article 5 of the Law exists.
3.2.1. Explicit Consent of the Data Subject
One of the conditions for the processing of personal data is the explicit consent of the data subject. The explicit consent of the data subject must be disclosed based on informed consent, and it must be given freely and with free will. TEKSOY TOURISM obtains explicit consent through relevant methods from customers, potential customers, and visitors for the processing of their personal data.
3.2.2. Clearly Foreseen in the Laws for Personal Data Processing Activities
If personal data processing is clearly foreseen in the laws, personal data can be processed without the explicit consent of the data subject.
3.2.3. Inability to Obtain Explicit Consent Due to Impossibility
In cases where it is impossible to obtain explicit consent due to factual impossibility or the person is unable to express consent, and processing personal data is necessary to protect the life or bodily integrity of the data subject or another person, personal data may be processed.
3.2.4. Directly Related to the Establishment or Performance of a Contract
If the processing of personal data is necessary for the establishment or performance of a contract, personal data can be processed.
3.2.5. Fulfillment of Legal Obligations of TEKSOY TOURISM
If the processing of personal data is necessary for TEKSOY TOURISM to fulfill its legal obligations, personal data may be processed.
3.2.6. Disclosure of Personal Data by the Data Subject
If the data subject has publicly disclosed their personal data, TEKSOY TOURISM may process the relevant personal data.
3.2.7. Mandatory Processing for the Establishment, Exercise, or Protection of a Right
If personal data processing is mandatory for the establishment, exercise, or protection of a right, personal data may be processed.
3.2.8. Mandatory Processing for the Legitimate Interests of TEKSOY TOURISM
Personal data may be processed for the legitimate interests of TEKSOY TOURISM, provided that it does not harm the fundamental rights and freedoms of the data subject.
3.3. Processing of Special Categories of Personal Data
TEKSOY TOURISM complies with the regulations specified in the Law regarding the processing of special categories of personal data. Special categories of personal data are processed by TEKSOY TOURISM in the following cases:
With the explicit consent of the data subject.
In cases where the explicit consent is not obtained, special categories of personal data other than health and sexual life can be processed if it is explicitly permitted by the laws.
Health-related and sexual life-related special categories of personal data are processed by individuals or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and their financing.
TEKSOY TURİZM, legal purposes of processing personal data in accordance with the law, takes necessary security measures to transfer the data owner's personal information and specially qualified personal data to third parties domestically or internationally. In this regard, TEKSOY TURİZM complies with the regulations outlined in Item 8 of the Personal Data Protection Law
4.1. Transfer of Personal Data to Third Parties within the Country
Personal data can be transferred by TEKSOY TOURISM if at least one of the data processing conditions specified in Items 5 and 6 of the Law exists and subject to compliance with the basic principles related to data processing conditions explained under the 3rd heading of this Policy.
4.2. Transfer of Personal Data to Third Parties Abroad
TEKSOY TURİZM, under the 3rd heading of this Policy, may transfer the personal data and specially qualified personal data of the data owner to third parties abroad, provided that at least one of the data processing conditions explained is present and necessary security measures are taken. Personal data processed by TEKSOY TURİZM may be transferred to foreign countries ("Countries with Adequate Protection") declared by the Personal Data Protection Board to have adequate protection, or in the absence of adequate protection, to foreign countries where data controllers in Turkey and the relevant foreign country have committed to providing adequate protection in writing and with the permission of the Personal Data Protection Board ("Country of Data Controller Committing Adequate Protection"). In this regard, TEKSOY TURİZM complies with the regulations outlined in Article 9 of the Personal Data Protection Law.
4.3. Third Parties to Whom Personal Data is Transferred and Purposes of Transfer
TEKSOY TOURISM can transfer data in compliance with the general principles of the Law and data processing conditions specified in Items 8 and 9 to the categories of parties categorized in the table below:
5.1. Rights of the Data Subject:
Learning whether personal data is processed and request information if processed.
Requesting information if personal data has been processed.
Learning the purpose of processing personal data and whether they are used appropriately for their purpose.
Knowing the third parties to whom personal data is transferred, whether domestically or abroad.
Requesting correction of personal data if it is incomplete or incorrectly processed and request notification of the correction made to third parties to whom the personal data has been transferred.
Requesting the deletion, destruction, or anonymization of personal data in case the reasons requiring its processing cease to exist, despite being processed in accordance with the provisions of the Law and other relevant laws, and request notification of the transaction made to third parties to whom the personal data has been transferred.
Objecing to the occurrence of a result against the individual by analyzing the processed data exclusively through automated systems. Requesting compensation for the damages incurred due to the unlawful processing of personal data.
5.2. Cases where the Data Subject Cannot Assert Their Rights:
Personal data owners cannot assert their rights as listed in Item 5.1 in the cases excluded from the scope of the Personal Data Protection Law, in accordance with Item 28 of the Personal Data Protection Law:
The processing of personal data by individuals solely within the scope of activities related to themselves or family members living in the same household, provided that it is not disclosed to third parties and the obligations regarding data security are adhered to.
The processing of personal data for research, planning, and statistical purposes by rendering them anonymous through official statistics.
The processing of personal data for artistic, historical, literary, or scientific purposes, or for the freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, the privacy of private life, or individual rights, and does not constitute a crime.
The processing of personal data by public institutions and organizations authorized by law to carry out preventive, protective, and intelligence activities for ensuring national defense, national security, public safety, public order, or economic security.
The processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial, or execution processes.
In accordance with Item 28.2 of the Personal Data Protection Law, personal data owners cannot assert their rights, except for the right to request remedy for damages, listed in 5.1 in the following cases:
When processing of personal data is necessary for the prevention of a crime or for the investigation of a crime,
Processing of personal data that has been publicly disclosed by the data subject,
When personal data processing is necessary for the performance of duties and powers by authorized public institutions and organizations or professional organizations with the status of a public institution, for the conduct of inspection or regulation duties, or for the investigation or prosecution of disciplinary matters,
When processing of personal data is necessary for the protection of the State's economic and financial interests concerning budget, tax, and financial matters.
Even if personal data has been processed in compliance with the relevant legal provisions stipulated in Item 138 of the Turkish Penal Code and Item 7 of the Personal Data Protection Law, if the reasons necessitating its processing cease to exist, TEKSOY TURİZM deletes, destroys, or anonymizes personal data based on the decision of TEKSOY TURİZM or upon the request of the data subject. In this context, TEKSOY TURİZM has implemented necessary technical and administrative measures within the Company to fulfill its obligations; has established operational mechanisms; and, in order to comply with these obligations, educates relevant departments, assigns responsibilities, and ensures awareness.
To convey all your questions and opinions about the Personal Data Protection Policy, contact us!