• Home
  • PERSONAL DATA PROTECTION, PRIVACY AND RETENTION (OR DISPOSAL) POLICY

PERSONAL DATA PROTECTION, PRIVACY AND RETENTION (OR DISPOSAL) POLICY

GENEL TRANSPORT FORWARDING & TRADE CO. LTD, in its capacity as data controller, processes and maintains the personal data of its customers, business partners and employees, who contact the company on their behalf or as representatives of a company or another organization, as well as the personal data of natural persons who establish contact with the company either by applying for a job or visiting the company’s website in accordance with the Protection of Personal Data Law No. 6698 (“KVKK”), published in the Official Gazette dated 7.04.2016 at number 29677.

1. OBJECTIVE

This policy concerns the Protection of Personal Data, which is important for GENEL TRANSPORT FORWARDING & TRADE CO. Ltd (hereinafter referred to as “Company” or “GENEL TRANSPORT FORWARDING & TRADE CO. Ltd”) and was created within the scope mandated by the Law; its objective is managed by this policy for protecting the personal data of our customers, potential customers, prospective customers, employee candidates, employees, company shareholders, company officials, visitors, as well as those of the employees, shareholders and officials of the companies and third parties we cooperate with, and informing all these individuals regarding the particulars of this policy.

As GENEL TRANSPORT FORWARDING & TRADE CO. Ltd, with the aim of protecting the personal data of all natural persons with whom we are in any way in contact and entirely fulfilling the requirements of the Personal Data Protection Law, while performing our commercial activities, we determine the basic principles and procedure to comply with the regulations stipulated under the Personal Data Protection Act number 6698, on the processing and protection of personal data. Within this scope, we ensure the necessary clarification and transparency by providing our contacts (in particular our customers, potential customers, prospective customers, employee candidates, company shareholders, company officials, visitors, employees and officials of the institutions we cooperate with, as well as the third parties whose data is processed by our company) with the appropriate associated information.

2. SCOPE

This policy is applied to all processes and transactions of GENEL TRANSPORT FORWARDING & TRADE CO. Ltd that fall within the scope of the subject regulation and covers GENEL TRANSPORT FORWARDING & TRADE CO. Ltd employees, employment candidates, active and potential customers, prospective customers, visitors, suppliers and any other natural person who is in connection with GENEL TRANSPORT FORWARDING & TRADE CO. Ltd

3.LEGAL BASIS

This policy covers the Personal Data Protection Act nr. 6698 and the relevant secondary legislations.

4.DEFINITIONS AND ABBREVIATIONS

The explanations and abbreviations of some definitions that take place in the text are used as reflecting the expressions used in the cited law and their explanations are provided here below.

Explicit Consent

Explicit consent means consent on a specific subject, based on the information received and/or available and declared by free will.

Disposal

Disposal means the deletion, destruction and/or anonymization of personal data.

Law

In this particular context Law means the Personal Data Protection Act (KVKK), number 6698.

Recording Medium

Recording Medium means any medium containing personal data, processed by non-automatic means, provided that it is fully or partially automated or it is part of any data recording system.

Personal data

Personal Data means any information relating to an identified or identifiable natural person.

Processing of personal data

Processing of personal data means any operation performed on personal data such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, acquiring, making retrievable, classifying or preventing from use through non-automatic means, provided that the personal data is fully or partially part of any automatic means of communication or data registry system.

Anonymization of Personal Data

Anonymization of personal data means processing such personal data in a manner as to make it impossible to associate such data with any identified or identifiable natural person under any circumstance, even by matching or comparing it with any other data.

Erasure of Personal Data

Erasure of personal data means making personal data inaccessible and unusable in any way or manner for each and all relevant users.

Disposal of Personal Data

Disposal of personal data means the process of rendering personal data inaccessible, irretrievable and unusable by anyone in any way or manner.

Board

Board means in this context the Personal Data Protection Board.

Sensitive Personal Data

Sensitive personal data means data related to race, ethnicity, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and/or attire, membership in associations, foundations and/or trade-unions, health, sexual orientation, convictions and security measures, as well as biometric and genetic data.

Periodical Disposal

Periodical disposal means deletion, disposal or anonymization processes, which are being carried out ex officio at repetitive intervals, as specified in the personal data storage and disposal policy, and/or in the event that all the personal data processing conditions laid down in the Law no longer exist.

Data Owner/Person of Interest

Data Owner or Person of Interest means in this context the natural person whose personal data is being processed.

Data Processor

Data Processor means the natural or legal person who processes personal data on behalf of the data controller, on the basis of the authority thereby delegated.

Data controller

Data Controller means the natural or legal person who determines the purpose and means of processing personal data and is responsible for the establishment and management of the data recording system.

Regulations

Regulations means in this context the Regulation on the Erasure, Disposal or Anonymization of Personal Data published in the Official Gazette on October 28, 2017.

Notification

Notification means in this context the “Notification on Application Procedures and Principles to the Data Controller” published in the Official Gazette dated March 10th, 2018, at number 30356.

5. PROCEDURES AND PRINCIPLES REGARDING THE PROTECTION OF PERSONAL DATA

GENERAL PRINCIPLES

GENEL TRANSPORT FORWARDING & TRADE CO. Ltd processes personal data in compliance with the procedures and principles stipulated under KVKK and other applicable laws. The data processed can be processed in compliance with KVKK as follows: personal data processed by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd are kept honestly and accurately, in accordance with the Law, updated when necessary, only for specific and legitimate purposes and only for the period stipulated in the relevant legislation or required for the purpose they are being processed. In this context, if an anticipated period is stipulated in the relevant legislation for data storage, GENEL TRANSPORT FORWARDING & TRADE CO. Ltd complies with this stipulation. If such period is not stipulated, the company retains the data for the period strictly necessary for the purpose for which it was processed. Unless stipulated by law, GENEL TRANSPORT FORWARDING & TRADE CO. Ltd does not store data based on the possibility of future use.

6. PERSONAL DATA PROTECTION AND PRIVACY

     6.1. PERSONAL DATA PROCESSING CONDITIONS

Apart from the exceptions listed in the Law, GENEL TRANSPORT FORWARDING & TRADE CO. LTD processes personal data only by obtaining the explicit consent of the data owners. However, in case the following conditions listed in the Law exist, personal data can be processed even without the explicit consent of the data owner, where the requirement is:

  • Clearly stipulated by the Law
  • Mandatory for the protection of the life or physical integrity of the person or of any other person who is actually incapable of giving consent or whose consent is not deemed legally valid.
  • Necessary to process personal data belonging to contracting parties, provided that it is directly related to the establishment or fulfilment of the contract.
  • Mandatory for the data controller to comply with its legal obligations.
  • Made public by the data owner itself.
  • Mandatory for the establishment, exercise or protection of rights.
  • Mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner.

GENEL TRANSPORT FORWARDING & TRADE CO. Ltd will take a considerate approach in processing sensitive personal data, which is more critically important for the data owner.
In this context, in addition to the conditions of not processing sensitive personal data without explicit consent of data owners, it is also necessary to comply with the rule of taking adequate precautions as determined by the Board. Such data, i.e., data related to race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations and/or trade-unions, health, sexual orientation, convictions and security measures, as well as biometric and genetic data, is not processed without the explicit consent of the data owners.

Sensitive personal data can only be processed with the explicit consent of the personal data owner by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd in line with the relevant provisions of the KVKK, provided that adequate measures determined by the KVKK Board for processing the personal data with sensitive nature are taken. In case the personal data owner has not given explicit consent, sensitive personal data, except health and sexual orientation of the personal data owner, fall under exceptions stipulated by the laws; sensitive data related to the health and sexual orientation of the data owner can only be processed by persons bound by confidentiality obligations or by authorized institutions and solely for the protection of public health, carrying out preventive medicine, medical diagnosis, treatment and nursing services, or planning and financing the management of health services.

6.2. PURPOSE OF PROCESSING PERSONAL DATA

Your personal data obtained by GENEL TRANSPORT FORWARDING & TRADE CO. LTD may be processed within the scopes described herein: HR operations, internal operations, activities with legal, technical and administrative consequences, strategy, planning and business partners/supplier and customer management, planning and execution of corporate communication activities/events, planning and execution of in-company training programs, Company Workplace Safety, Worker and Occupational Protection of Health and Safety, performing after-sales services, making collections, carrying out studies to improve service quality for providing better service, invoice issuing in return for services, outsourcing service procurement, procuring services in areas outside of the expertise of the company, confirming identity, responding to questions and complaints, taking the necessary technical and administrative measures within the scope of data security, ensuring financial agreement with relevant business partners and other third parties regarding the products and services, providing the necessary information in line with the requests and inspections of regulatory and supervisory institutions and official authorities, preserving information on data that must be kept in compliance with the relevant legislation, ensuring the consistency of information, measuring customer satisfaction; with regard to employees: creating personal files, determining the capability of continuously fulfilling the job requirements, making complementary health insurance, creating health files, taking occupational safety measures, making travel plans; with regard to employment candidates: managing and planning the evaluation process of candidates’ suitability for open positions, fulfilling legal obligations, executing/following-up of financial reporting and risk management transactions, executing/following-up legal affairs, creating and following-up visitors’ records; planning and executing employees’ machinery and equipment usage, planning and executing sales transactions, planning and executing supply transactions, planning and executing collections, planning and executing the usage of the Company’s internet, public network, computer equipment, in accordance with the law.
The above stated purposes are for information purposes only and any addition that may be required for GENEL TRANSPORT FORWARDING & TRADE CO. Ltd to carry out commercial and operational activities in future will be announced and/or updated as necessary.

6.3. STORAGE OF PERSONAL DATA

The personal data we obtain are securely stored in physical or electronic environment for a certain period of time, in order for GENEL TRANSPORT FORWARDING & TRADE CO. Ltd to carry out its commercial activities. Within the scope of these activities, GENEL TRANSPORT FORWARDING & TRADE CO. Ltd acts in accordance with the obligations regarding the protection of personal data stipulated in all relevant legislation, particularly the KVKK. In the event that the purposes for processing personal data expire, with the exception of cases where personal data is allowed or required to be stored for a longer period of time in accordance with the relevant legislation, data will be deleted, disposed of or anonymized by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd with different procedures ex officio or upon the request of the data owner. In case the personal data is deleted by such methods, the data will be disposed of in a way that it cannot be retrieved and used again. In case where the data controller has a legitimate interest, personal data may be stored, if allowed by the law, in spite of the reasons for processing and/or the periods specified in the relevant laws being expired, if it does not harm the fundamental rights and freedoms of the data owners. After the expiry of the aforementioned statute of limitations, the personal data will be deleted, disposed or anonymized according to the above-mentioned procedures.

6.4. TRANSFERRING PERSONAL DATA TO DOMESTIC PERSONS

GENEL TRANSPORT FORWARDING & TRADE CO. Ltd complies with the conditions set forth in the KVKK rules regarding the sharing of personal data with third parties, without prejudice to the provisions of other laws. In this context, the personal data is not transferred to third parties by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd unless it can be transferred without the explicit consent of the data owner. However, the conditions in which the Personal Data can be transferred without the explicit consent of the data owner are regulated as follows under the KVKK, where such occurrence is:

  • Clearly stipulated by the Law,
  • Mandatory for the protection of the life or physical integrity of the person or of any other person who isactually incapable of giving consent or whose consent is not deemed legally valid,
  • Necessary to process personal data belonging to contracting parties provided that it is directly relatedto the establishment or fulfilment of the contract,
  • Mandatory for the data controller to be able to perform legal obligations,
  • Made public by the data owner itself,
  • Mandatory for the establishment, exercise or protection of a right,
  • Mandatory to process data in the legitimate interest of the data controller, provided that it does not harmthe fundamental rights and freedoms of the data owner.
  • Provided that adequate measures determined by the KVKK Board are taken for processing the personaldata of sensitive nature.

In case the personal data owner has not given explicit consent: sensitive personal data, except health and sexual orientation of the personal data owner, fall under exceptions stipulated by the laws, sensitive data related to the health and sexual orientation of the data owner can only be processed by persons bound by confidentiality obligations or by authorized institutions and solely for the protection of public health, carrying out preventive medicine, medical diagnosis, treatment and nursing services, or planning and financing the management of health services.

For transferring sensitive personal data, the conditions specified in the processing circumstances of the sensitive data and the determinations of the law must be complied with.

6.5. TRANSFERRING PERSONAL DATA ABROAD

Regarding the transfer of personal data abroad, personal data cannot be transferred abroad without explicit consent of the data owner. If conditions allowing the processing of personal data without the explicit consent of the data owner exist, personal data may be transferred abroad by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd without seeking the explicit consent of the data owner, provided that sufficient protection is available in the foreign country where the personal data is supposed to be transferred.

If the transfer country is not identified by the Board among the countries where there is sufficient protection, GENEL TRANSPORT FORWARDING & TRADE CO. Ltd and the data controller/data processor in the relevant country will undertake in writing that the permission of the Board and adequate protection will be assured.

As clearly stated in the law personal data may be transferred abroad without explicit consent of the data owner provided that one of the conditions set forth in the second paragraph of Article 5 and the third paragraph of Article 6 exist in the foreign country where the personal data will be transferred, i.e. (a) sufficient protection is provided, (b) the controllers in Turkey and in the related foreign country guarantee sufficient protection in writing and the Board authorizes such transfer. The countries with sufficient level of protection are determined and announced by the Board. In cases where the interests of Turkey or the data owner could be seriously harmed, such personal data, without prejudice to the provisions of international agreements, may only be transferred abroad upon the Board’s permission after receiving the opinions of the related public institutions and organizations. The provisions of other laws concerning the transfer of personal data abroad will be observed. GENEL TRANSPORT FORWARDING & TRADE CO. Ltd will ensure that the necessary procedures are carried out in order to comply with the provision of the law on international transfers of data.

7. OBLIGATION OF GENEL TRANSPORT FORWARDING & TRADE CO. LTD

Within the scope of Article 10 of the KVKK, data owners must be informed before or at the latest in the process of obtaining personal data. The information to be conveyed to the data owners within the framework of the disclosure obligation is as follows: the identity of the controller and its representative, if any; the purpose of processing data; to whom and for what purposes the processed data may be transferred; method and legal reasons of collecting personal data; other rights listed in in Article 11. GENEL TRANSPORT FORWARDING & TRADE CO. Ltd has prepared its disclosure statement in order to fulfil its obligation to inform third parties. After submitting the disclosure statements to the data owners, explicit consent statements have been prepared for the data processing activities and the data categories that require the explicit consent of the data owner in order for GENEL TRANSPORT FORWARDING & TRADE CO. Ltd to carry out its commercial activities. These statements include the purposes for which the data will be processed, to whom it can be transferred and for what purposes, the collection method and the rights of the data owner. GENEL TRANSPORT FORWARDING & TRADE CO. Ltd can satisfy its disclosure responsibility by all means which are relevant for obtaining consent in accordance with the law. Exceptions to enable processing of personal data in accordance with the law have been made on item 5/2 of KVKK. GENEL TRANSPORT FORWARDING & TRADE CO. Ltd accordingly may also process personal data in the presence of one or the other conditions (exceptions) listed below, apart from explicit consent: the basis for the personal data processing activity can be only one of, or more than one of the conditions listed below, which can be the basis of the same personal data processing activity:

  • Clearly stipulated by the Law,
  • Mandatory for the protection of the life or physical integrity of the person or of any other person who is actually incapable of giving consent or whose consent is not deemed legally valid,
  • Directly related to the establishment or fulfilment of the contract,
  • For the GENEL TRANSPORT FORWARDING & TRADE CO. Ltd to be able to comply with its legal obligations,
  • Made public by the data owner itself,
  • Mandatory for the establishment or protection of rights,
  • Mandatory to process the data for the legitimate interests of GENEL TRANSPORT FORWARDING & TRADE CO. Ltd, provided that it does not harm the fundamental rights and freedoms of the data o

8. RIGHTS OF THE DATA OWNER

The required notifications and measures for the data owners to exercise the rights granted to them in Article 11 of the KVKK have been applied by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd. In case such request is made, it will be satisfied in accordance with the Law. These rights are as follows.

    • The data owner has the right to:
      a. Learn whether personal data is processed or not;
      b. Request information, if personal data is processed;
      c. Learn the purpose of data processing and whether this data is used for the intended
      purposes;
      d. Receive information about the domestic or foreign third parties to whom personal data is transferred;
      e. Request rectification, in case data is incompletely or inaccurately processed;
      f. Request the erasure or disposal of personal data as stipulated in Article 7;
      g. Request third parties to whom personal data has been transferred to notify the operations carried out in compliance with subparagraphs (e) and (f);
      h. Object to the exclusively automatic processing of personal data leading to unfavourable consequence for the data owner;
      i. Request compensation, in case of damage resulting from unlawful processing of personal data.
      In accordance with paragraph 1 of Article 13 of the KVKK, Personal Data Right Holders can submit their request to avail themselves of the mentioned rights with the following methods and information, in accordance with the “Notice on the Procedures and Principles of Application to the Data Controller”, published in the Official Gazette on March 10th, 2018, at number 30356:
      • Information required in the application: Name and Surname of the applicant;
        – Turkish ID number, if the applicant is a citizen of the Republic of Turkey, if not, passport number along with nationality or identification number, if applicable;
        – Applicant’s residence or workplace address as address for service;
        – Applicant’s e-mail address, telephone, or fax;
        – The subject of the applicant’s request;
        – Information and documents regarding the applicant’s request;
      • Application methods that can be used by the concerned person:
        – The applicant can personally fill in the application request including the above explanations in accordance with KVKK 13 and deliver it in person to the company’s address at Cumhuriyet Caddesi No: 123/6 TR 34373 Harbiye Istanbul-Turkey, in a sealed envelope bearing the note “Request in accordance with the Law on the Protection of Personal Data” and demand a receipt in exchange.
        – The applicant can send a notification to the Company Address through a Notary Public with the note “Request in accordance with the Law on the Protection of Personal Data” added on the notification envelope.
        – The applicant can apply by sending an email to our Company’s Registered Electronic Mail address generaltransport@hs01.kep.tr adding the subject line “Request in accordance with the Law on the Protection of Personal Data”, signed with a “Secure Electronic Signature”, as defined in the Electronic Signature Law No. 5070.

GENEL TRANSPORT FORWARDING & TRADE CO. Ltd will physically or electronically deliver its reply to the relevant application of the applying data owner to the elected address for service. GENEL TRANSPORT FORWARDING & TRADE CO. Ltd, depending on the nature of the request, will conclude the request free of charge as soon as possible, within thirty (30) days at the latest. However, if the process incurs an additional cost, the fee contained in the tariff determined by the Board will be collected from the relevant parties. In addition, during the process of finalizing the data owners’ requests, additional information or documents may be requested from the applicants by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd However, within the framework of Article 28 (2) of the KVKK and excluding the right to damage repair, the above rights, as listed in Article 11 of the KVKK, will not be applicable in the following cases:

    • the personal data processing is required for the prevention of crime or for criminal investigation,
      – and/or the personal data is made public by the data owner itself,
      – and/or the personal data is required for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by official and authorized public institutions and organizations and/or associations acting as public institution, based on the authority given by the Law,
      – and/or the personal data is required for the protection of the economic and financial interests of the State with regard to budget, tax and financial matters.

9. MEASURES TAKEN FOR DATA SECURITY

GENEL TRANSPORT FORWARDING & TRADE CO. Ltd takes all required technical and administrative measures to ensure the appropriate level of security required for the protection of personal data. The measures stipulated in Article 12(1) of the KVKK are as follows:

  • Preventing the unlawful processing of personal data,
  • Preventing unlawful access to personal data,
  • Ensuring the protection of personal data.

The measures taken by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd in this context are as follows:

15.CIRCULATION

This policy is announced to third parties and company employees by being published on GENEL TRANSPORT FORWARDING & TRADE CO. Ltd website and at the company’s headquarters through various communication tools.

16. REVISION AND ABOLITION

This Policy is reviewed and updated by GENEL TRANSPORT FORWARDING & TRADE CO. Ltd Legal Counsel in line with the newly issued notices, secondary legislation and/or other legal regulations. In case KVKK and other relevant legislation provisions are deemed to be in conflict with the policy herein specified, KVKK and other relevant legislation provisions will prevail.

17. VALIDITY

This policy prepared by GENEL TRANSPORT FORWARDING & TRADE CO. LTD has been revised with its latest updates and entered into force on…………..