Kozyatağı, Kadıköy, İstanbul - Türkiye
support@albisec.com0850 307 03 34ENTR
Albisec – Always Being Secured
Support

KVKK Privacy Notice

Updated:

This English translation is provided for information only. In case of any discrepancy, the Turkish original prevails.

Notice on the Processing of Personal Data

This Privacy Notice has been prepared by Albisec Bilişim Teknolojileri A.Ş. (the “Company”) to inform the Company’s customers about the processing of their personal data by the Company under the Personal Data Protection Law No. 6698 (the “Law”, also known as KVKK).

Further details on how your personal data is processed under this Notice are available in the Albisec Personal Data Protection and Processing Policy published at www.albisec.com.

Your personal data is collected electronically or on paper. Personal data collected on the legal grounds stated in this Notice may be processed and shared within the conditions for processing personal data set out in Articles 5 and 6 of the Law.

b) Purposes of processing

Within the conditions set out in Articles 5 and 6 of the Law, your personal data is processed by the Company for the purposes of: planning and carrying out the activities required to tailor, recommend and promote the Company’s products and services to data subjects according to their preferences, usage habits and needs; carrying out the work and business processes required for data subjects to benefit from the Company’s products and services; carrying out the work and business processes required for the Company’s commercial activities; planning and executing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial security of the Company and of persons in a business relationship with the Company.

c) Parties with whom personal data may be shared, and why

Within the conditions and purposes set out in Articles 8 and 9 of the Law, and for the purposes listed in section (b), your personal data may be shared with the Company’s business partners and suppliers, with legally authorised public institutions and organisations, and with legally authorised private-law legal entities.

d) Rights of data subjects and how to exercise them

If you submit a request regarding the rights listed below using the methods described under Exercising your rights, the Company will assess and conclude your request as soon as possible and in any case within 30 (thirty) days.

Under Article 11 of the Law, as a data subject you have the right to:

  • learn whether your personal data is being processed;
  • request information about the processing, if your personal data has been processed;
  • learn the purpose of the processing and whether the data is used in accordance with that purpose;
  • know the third parties in Türkiye or abroad to whom your personal data has been transferred;
  • request the correction of incomplete or inaccurate personal data and request that third parties to whom the data was transferred be notified of the correction;
  • request the deletion or destruction of your personal data where the reasons for processing no longer exist, even though it was processed in accordance with the Law and other applicable laws, and request that third parties to whom the data was transferred be notified accordingly;
  • object to an outcome against you that arises from the analysis of your data exclusively by automated systems;
  • claim compensation for damages arising from the unlawful processing of your personal data.

Article 28(2) of the Law lists the cases in which data subjects cannot exercise the rights above, namely where processing is:

  • necessary to prevent a crime or for a criminal investigation;
  • of personal data made public by the data subject;
  • necessary for authorised public institutions and professional organisations with public-institution status to carry out supervisory or regulatory duties, or for disciplinary investigations or prosecutions, based on powers granted by law;
  • necessary to protect the economic and financial interests of the State in relation to budget, tax and financial matters.

Under Article 28(1) of the Law, the following processing falls outside the scope of the Law, so requests will not be processed for such data either:

  • processing by natural persons solely in connection with activities concerning themselves or family members living in the same household, provided the data is not disclosed to third parties and data security obligations are met;
  • processing for research, planning and statistical purposes after anonymisation through official statistics;
  • processing for artistic, historical, literary or scientific purposes, or within freedom of expression, provided it does not violate national defence, national security, public safety, public order, economic security, privacy or personal rights, or constitute a crime;
  • processing within preventive, protective and intelligence activities carried out by public institutions authorised by law to ensure national defence, national security, public safety, public order or economic security;
  • processing by judicial authorities or enforcement offices in connection with investigation, prosecution, trial or enforcement proceedings.

Exercising your rights

  • Data subjects may use the contact form to exercise the rights described above.
  • Applications must be made, together with documents identifying the data subject, by one of the following methods:
    • sending a wet-signed copy of the request, written on A4 paper, to our address by hand, through a notary public or by registered mail with return receipt;
    • following a method prescribed by the Personal Data Protection Board.
  • The Company responds to data subjects wishing to exercise these rights within the limits of the Law, within a maximum of thirty (30) days as prescribed by the Law. For a third party to apply on behalf of a data subject, a special power of attorney issued through a notary public by the data subject is required.
  • Applications are processed free of charge as a rule; however, a fee may be charged according to the tariff set by the Personal Data Protection Board.
  • The Company may request information from the applicant to determine whether they are the data subject, and may ask questions about the application to clarify the matters it raises.