Ahde Vefa Law Office (hereinafter referred to as "Ahde Vefa") is aware of the effect of the protection of personal data, which is a constitutional right, on the execution of business relations on the basis of trust.
In this respect, the Processing, Protection and Destruction Policy of Personal Data ("Policy"), which is a guide for our company to fulfill its obligations regarding the protection and processing of personal data in accordance with the law, has been made available to those concerned.
Law No. 6698 on Protection of Personal Data (hereinafter referred to as "KVKK") constitutes the basis of this Policy. Compliance with legal regulations regarding the protection of personal data, especially KVKK, is among the priorities of our company.
In this context, necessary administrative and technical measures are taken by Ahde Vefa for the protection of personal data processed in accordance with the relevant legislation. In this Policy, detailed explanations regarding the basic principles adopted by Ahde Vefa in the processing of personal data and listed below will be made:
The main purpose of this Policy is to make explanations about the personal data processing activities carried out by Ahde Vefa in accordance with the law and the systems adopted for the protection of personal data, in this context, customers, customer employees, suppliers, consultants, supplier employees, employee candidates, employees, employee relatives, interns To ensure transparency by informing the persons whose personal data are processed by our company, especially the company officials, visitors, news subjects and third parties.
By publishing this Policy, Ahde Vefa aims to provide the necessary information regarding the personal data processing activities it carries out and thus ensure that these activities are carried out in accordance with the legislation and in a transparent manner.
The policy reveals the basic principles adopted by Ahde Vefa in the processing of personal data, as well as determining the processing conditions of personal data.
The scope of this Policy includes customers, customer employees, suppliers, consultants, supplier employees, employee candidates, employees, relatives of employees, interns, company officials, visitors, persons in the news and third parties automatically or non-automatically provided that they are part of any data recording system. all personal data processed by means.
Personal Data: All kinds of information regarding an identified or identifiable natural person.
Relevant Person: The real person whose personal data is processed.
Data Controller: Natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Law: Law No. 6698 on Protection of Personal Data.
Regulation: Regulation on Deletion, Destruction or Anonymization of Personal Data.
Board: Personal Data Protection Board.
Private Personal Data: Race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and dress, association, foundation or union membership, health, sexual life, criminal conviction and biometric and genetic data with data on security measures.
Processing of Personal Data: Acquisition, recording, storage, preservation, modification, rearrangement, disclosure, transfer of personal data by fully or partially automatic means or non-automatic means provided that it is a part of any data recording system, any transaction performed on the data such as taking over, making it available, classifying or preventing its use.
Explicit Consent: Consent regarding a specific subject, based on information and declared with free will.
Recipient Group: The real or legal person category to which personal data is transferred by the data controller.
Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authorization given by the data controller.
Personal Data Processing Inventory: Personal data processing activities performed by data controllers depending on the business processes; The inventory that they have created by associating with the data category, the recipient group and the data subject group of personal data processing purposes and the legal reason, explaining the maximum retention period required for the purposes for which the personal data is processed, the personal data foreseen to be transferred to foreign countries and the measures taken regarding data security.
Recording Medium: Any medium containing personal data that is fully or partially automated or processed in non-automatic ways provided that it is a part of any data recording system.
Destruction: Deletion, destruction or anonymization of personal data.
Anonymization: Making personal data unrelated to an identified or identifiable natural person under any circumstances, even by matching other data.
Deletion of Personal Data: Making personal data inaccessible and unusable for the relevant users in any way.
Destruction of Personal Data: The process of making personal data inaccessible, unrecoverable and reusable by anyone.
Periodic Destruction: The process of deletion, destruction or anonymization to be carried out ex officio at repetitive intervals specified in the policy in case all of the processing conditions of personal data specified in the law are eliminated.
Policy: Ahde Vefa's Processing, Protection and Destruction Policy of Personal Data
The relevant legal regulations in force regarding the processing and protection of personal data will primarily be applied. In case of inconsistency between the current legislation and the Policy, our company accepts that the current legislation will be applied.
The policy is created by concretizing and regulating the rules laid down by the relevant legislation within the scope of Ahde Vefa practices. Our company carries out the necessary systems and preparations to act in accordance with the effective periods stipulated in the KVKK.
This Policy prepared by our company was revised on 13.10.2020 and entered into force. In case all or certain articles of the policy are renewed, the effective date of the Policy will be updated.
On the website of our policy companywww.ahdevefalawoffice.com is published on the website and made available to the relevant persons upon the request of the personal data owners.
Ahde Vefa reserves the right to make changes in the Policy due to changes in the Law or in line with developments in the sector or informatics.
In accordance with Article 12 of the KVKK, our company takes the necessary technical and administrative measures to prevent unlawful processing of the personal data it processes, to prevent unlawful access to the data and to ensure the appropriate security level, and conducts the necessary audits within this scope.
Our company takes technical and administrative measures according to technological possibilities and implementation costs in order to ensure that personal data are processed in accordance with the law.
Our company takes technical and administrative measures according to the nature of the data to be protected, technological possibilities and implementation costs in order to prevent the imprudent or unauthorized disclosure of personal data, access, transfer or any other unlawful access.
Our company takes the necessary technical and administrative measures according to the technological possibilities and implementation costs in order to keep personal data in secure environments and to prevent destruction, loss or change for illegal purposes.
Our company carries out the necessary inspections within its body in accordance with Article 12 of the KVKK. These audit results are reported to the relevant department within the scope of the internal operation of the company and necessary actions are carried out to improve the measures taken.
Personal data belonging to data owners are securely stored by Ahde Vefa in the following environments, in accordance with the relevant legislation, especially the provisions of KVKK, and within the framework of international data security principles.
The recording media used for the storage of personal data are generally listed below. Ahde Vefa acts in the capacity of data controller in any case and processes and protects personal data in accordance with the Law and this Policy.
Physical environments; All kinds of documents that can be printed on paper and the like, the media where the data is printed on the file
Electronic media; Servers within Ahde Vefa (Exchange server, payroll program, file server), fixed or removable disks,
Internet-based servers and other areas that are not included in Ahde Vefa and are cryptographically encrypted in the use of Ahde Vefa
Our company; acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty in the processing of personal data. In this context, our company takes into account the proportionality requirements in the processing of personal data, and does not use personal data outside of the purpose required.
Our company; It ensures that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights of personal data owners and their own legitimate interests. It takes the necessary measures in this direction.
Our company clearly and precisely determines the legitimate and legal purpose of processing personal data. Our company processes personal data in connection with the service it provides and as required for them. The purpose for which personal data will be processed by our company is revealed before the personal data processing activity begins.
Our company processes personal data in a way that is convenient for the realization of the specified purposes and avoids the processing of personal data that is not related to the realization of the purpose or is not needed. For example, personal data processing activity is not carried out to meet the needs that may arise later.
Our company keeps personal data only for the period specified in the relevant legislation or for the purpose for which they are processed. In this context, our company firstly determines whether a period is stipulated for the storage of personal data in the relevant legislation, if a period is specified, it acts in accordance with this period, if a period is not determined, it stores the personal data for the period required for the purpose for which they are processed. Personal data are deleted, destroyed or anonymized by our company in the event of the expiration of the period or the disappearance of the reasons for processing.
Our company is able to transfer the personal data and private personal data of the personal data owner to third parties (authorized public institutions and organizations, real or private law legal persons) by taking the necessary security measures in line with the legal personal data processing purposes. In this direction, our company acts in accordance with the regulations stipulated in Article 8 of the KVKK.
Your personal data obtained by our company are processed for the following purposes.
In case it is stipulated in the relevant laws and regulations, our company keeps personal data for the period specified in these regulations.
If a period of time is not regulated in the legislation regarding how long personal data should be stored, personal data are processed for a period of time that requires processing in accordance with the practices of our Company and the practices of our business life, depending on the services our company provides while processing that data, and then they are deleted or destroyed.
Personal data, whose storage period has expired, are destroyed within 6 (six) months of periods in accordance with the procedures set out in this Policy. All transactions regarding the deletion, destruction and anonymization of personal data are recorded and the said records are kept for at least 3 (three) years, excluding other legal obligations.
| PROCESS | STORAGE PERIOD | DESTRUCTION TIME |
|---|---|---|
| Evaluation of job applications | 1 year | During the first periodic destruction period following the expiry of the storage period |
| Managing Human Resources processes | 10 years from the termination of employment | During the first periodic destruction period following the expiry of the storage period |
| Employee health files | 15 years from the termination of employment | During the first periodic destruction period following the expiry of the storage period |
| Sales, marketing and purchasing activities | 10 years | During the first periodic destruction period following the expiry of the storage period |
| accounting transactions | 10 years | During the first periodic destruction period following the expiry of the storage period |
| Camera recordings | 30 days | During the first periodic destruction period following the expiry of the storage period |
| Process security data | 2 months | During the first periodic destruction period following the expiry of the storage period |
| www.ahdevefalawoffice.com website visitor data | 1 year | During the first periodic destruction period following the expiry of the storage period |
In accordance with Article 11 of the Regulation on Deletion, Destruction or Anonymization of Personal Data, Ahde Vefa has determined the periodic destruction period as 6 months.
Our company may transfer personal data to authorized public institutions and organizations, natural persons or private law legal entities, suppliers, customers, public, lawyers, banks in accordance with Articles 8 and 9 of the KVKK.
The explicit consent of the personal data owner is only one of the legal bases that enable the processing of personal data in accordance with the law. Apart from express consent, personal data may also be processed in the presence of one of the other conditions listed below. The basis of the personal data processing activity can be only one of the conditions stated below, and more than one of these conditions can also be the basis of the same personal data processing activity.
By our company; If the personal data of special nature does not have the express consent of the personal data owner, they are processed in the following cases, provided that adequate measures are taken by the KVK Board:
Although our company has been processed in accordance with the provisions of the relevant law as regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVKK, personal data will be deleted, destroyed or anonymous, based on our Company's own decision or upon the request of the personal data owner, in case the reasons for processing disappear. is made.
Blackout, Scribble: Blackout, smear, cutting the personal data on the relevant document whenever possible, and making it invisible and unreadable by using ink and pen in a way that is irreversible and cannot be read with technological solutions.
Physical Destruction: Physically kept documents are destroyed in such a way that they cannot be reunited with the document destruction machines.
Deletion from Software: Personal data hosted in the cloud or local digital environment are deleted by digital command so that they cannot be recovered. Data deleted in this way cannot be accessed again.
Physical Destruction: Physical destruction of optical and magnetic media containing personal data such as melting, burning, breaking, pulverizing. Burning, breaking, melting, or passing the media device through a metal shredder makes the data inaccessible.
Overwriting: It makes it impossible to read and recover old data by writing random data consisting of 0s and 1s at least seven times over magnetic media and re-readable optical media through special software.
Personal data owners;
Personal data owners cannot assert their rights enumerated in 10.1.1.
Pursuant to the article 28/2 of the KVKK, personal data owners cannot claim their other rights listed in 10.1.1.
Personal data owners have their requests regarding their rightskvkk@ahdevefalawoffice.com by e-mail to the address, www.ahdevefalawoffice.com ve www.ahdevefalawoffice.com You can fill in the "Data Owner Application Form" at the address of Ahde Vefa Law Office "Prof.Dr.Selahattin Yazıcıoğlu Cad. Yenisehir Mah. Sezai Karakoç Plaza Kat: 1 No: 5 YENİŞEHİR / DİYARBAKIR ”by mail.
It is not possible to make requests by third parties on behalf of personal data messages.
In order to make a request other than the personal data owner himself, a special power of attorney must be available on behalf of the person who will make an application by the personal data owner.
In accordance with the provisions of the Communiqué on Application Procedures and Principles to the Data Controller, applications must be made in English. In the application, the names, surnames and writing that the signature ID number for Turkey citizens, nationality for foreigners, passport number / ID number, notification residential or business address, if you notice essentially electronic addresses, telephone or fax number and request subject is required.
The method of the application is explained in detail in the application form that personal data owners will fill in to exercise their rights.
In case the application is rejected as per Article 14 of KVKK, the owner of the personal data, and the response is not responded in sufficient time or in time; When he learns the answer of our company, he can complain to the KVK Board within thirty days and at the end of it.
In case the personal data owner submits his request to our company in accordance with the procedure, our company will finalize the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request.
However, if the transaction requires an additional cost, our company will charge the applicant in the tariff determined by the KVK Board.
Our company may request information from the person concerned in order to determine whether the applicant is the owner of personal data.
In order to clarify the matters in the application of the personal data owner, our company may ask a question to the personal data owner about his application.
Our company may reject the application of the applicant by explaining the reason in the following situations:
You can access our application form here regarding your rights mentioned above.
Provided for your information.
AHDE VEFA LAW OFFICE