Paribu Biletleme Teknolojileri A.Ş. Personal Data Processing, Protection, Retention and Destruction Policy
Personal Data Processing, Protection, Retention and Destruction Policy
1. Introduction
The right to the protection of personal data — which includes the rights of a person to be informed about their personal data, to access the data, to request the correction or deletion of the data, and to learn whether it is used in line with its purpose — is protected under the Constitution of the Republic of Türkiye.
The Personal Data Protection Law No. 6698 ("KVKK" or the "Law") regulates the processing of personal data, the fundamental rights and freedoms of data subjects, the obligations of natural and legal persons processing data, and the procedures and principles to be complied with.
Within the scope of the protection of personal data — which is a constitutional right — Paribu Biletleme Teknolojileri A.Ş. ("Company" or "Paribu Biletleme") has, by means of this text, established the processing, protection, retention and destruction of personal data of relevant persons as a Company policy.
The information regarding the identity of the data controller for any personal data processing activity falling within the scope of this policy is set out below.
Data Controller: PARİBU BİLETLEME TEKNOLOJİLERİ ANONİM ŞİRKETİ
Address: Huzur Mahallesi Maslak Ayazağa Caddesi Uniq İstanbul Sitesi B Blok No: 4B Sarıyer/İstanbul (TÜRKİYE)
Email Address:[email protected] / [email protected]
2. Purpose
The aim of this Personal Data Processing, Protection, Retention and Destruction Policy ("Policy") is the effective implementation, within Paribu Biletleme Teknolojileri A.Ş., of the regulations to be introduced within the framework of the fundamental principles set out in the Personal Data Protection Law No. 6698 ("KVKK").
3. Scope
This policy has been prepared with the aim of determining the procedures and principles for the work and operations relating to the data processing, protection, retention and destruction activities carried out by Paribu Biletleme Teknolojileri A.Ş. This Policy applies to all recording environments in which the personal data of the Company's employees, employee candidates, customers, physical and virtual visitors, suppliers and other third parties is processed, and to activities directed at the processing of personal data.
The fundamental aim of this Policy is to provide explanations regarding the personal data processing activity carried out by Paribu Biletleme Teknolojileri A.Ş. in compliance with the law, and the systems adopted for the protection of personal data; in this context, to ensure transparency by informing existing and potential customers, employees, employee candidates, physical and virtual visitors, Company representatives, employees and representatives of the Company's affiliates, employees, shareholders and representatives of institutions with which it cooperates, and other persons whose personal data is processed by Paribu Biletleme Teknolojileri A.Ş., in particular third parties.
In respect of the processing and protection of personal data within the operation of the Company, plans will be made for taking the administrative and technical measures introduced by the applicable legislation, the necessary information will be provided to raise awareness, and the necessary measures will be taken under the KVKK to ensure compliance of employees and business partners with KVKK processes.
In the event that the said data does not have the nature of personal data, the processes relating to such data are conducted within the scope of this Personal Data Processing, Protection, Retention and Destruction Policy belonging to the Company.
4. Definitions
Anonymisation: Rendering data that has previously been associated with a person such that, even when matched with other data, it can no longer in any way be associated with an identified or identifiable natural person.
Relevant Person in Charge: Persons who process personal data within the data controller or in line with the authority and instructions received from the data controller, or persons responsible for the storage, protection and back-up of data.
Destruction: The deletion, destruction or anonymisation of personal data.
Law/KVKK: The Personal Data Protection Law No. 6698.
Recording Environment: Any environment in which personal data processed by wholly or partly automated means or by non-automated means as part of any data filing system is held.
Personal Data: Any information relating to an identified or identifiable natural person.
Personal Data Inventory: An inventory in which the data controller explains its personal data processing activities, depending on its business processes, in various categories such as processing purposes, the data subject group, data category, recipient group to which it is transferred, etc.
Personal Data Processing Activity: Any operation performed on data, such as obtaining, recording, storing, retaining, modifying, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by wholly or partly automated means or by non-automated means as part of any data filing system.
Board: The Personal Data Protection Board.
Authority: The Personal Data Protection Authority.
Customer: All natural persons to whom services are provided by Paribu Biletleme.
Special Categories of Personal Data: Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
Paribu/Company: Paribu Biletleme Teknolojileri A.Ş.
Periodic Destruction: The deletion, destruction or anonymisation operation to be carried out ex officio at the recurring intervals specified in this Policy, in the event that all of the conditions and purposes of processing of personal data have ceased.
Policy: Personal Data Processing, Protection, Retention and Destruction Policy.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller.
Data Subject/Relevant Person: The natural person whose personal data is processed.
Data Controller: The natural or legal person who determines the purposes and means of processing of personal data and is responsible for the establishment and management of the data filing system.
Data Controllers Registry (VERBİS): The registry of data controllers held under the umbrella of the Personal Data Protection Board.
5. General Principles
5.1. General Principles Regarding the Processing of Personal Data
The following principles are complied with in the processing of personal data:
Compliance with Law and Good Faith: Paribu Biletleme, as a prudent merchant, acts in compliance with the principles introduced by legal regulations and with the general rule of trust and good faith in the processing of personal data.
Being Accurate and, Where Necessary, Up to Date: Paribu Biletleme takes all necessary administrative and technical measures to ensure the accuracy and currency of personal data while carrying out personal data processing activity, taking into account the fundamental rights of personal data subjects and its own legitimate interests under the Personal Data Protection Law and the other laws with which it must comply within the scope of its activity.
Processed for Specified, Explicit and Legitimate Purposes: Paribu Biletleme clearly determines its purposes regarding the personal data processing activity. Within this scope, personal data is processed in line with the specified purposes, limited to the services to be provided or the legal obligations. The purpose for which personal data will be processed is set out before the personal data processing activity begins.
Being Connected, Limited and Proportionate to the Purposes for Which They Are Processed: Paribu Biletleme processes personal data to the extent necessary to achieve the determined purposes. By virtue of the principles of proportionality, a reasonable balance is struck between the data processing activity and the purpose intended to be achieved; within this scope, personal data not necessary for the realisation of the personal data processing activity is not collected and/or processed; in line with the principle of proportionality, the minimum level of information is requested from the data subject; data processing not necessary for purposes outside this is avoided; personal data is collected only for specified purposes and to the extent necessary, and is used where required by the purpose.
Being Retained for the Period Provided for in the Relevant Legislation or Necessary for the Purposes for Which They Are Processed: Paribu Biletleme retains personal data for the period provided for in the legislation or, where no period is provided for, for as long as the processing purpose requires. Upon expiry of the period or the cessation of the reasons, personal data is deleted, destroyed or anonymised. Where reasonable necessities are concerned, or where it is necessary to comply with legal or regulatory requirements, to resolve disputes, to prevent fraud and abuse, or to enforce other contracts and policies of the company, Paribu Biletleme may continue to retain such of the personal data relating to the processes as is necessary, even after the customer's membership account has been closed or the legal relationship with the counterparty has ended, even though we no longer need this information.
5.2. Personal Data Processing Activity
Any operation performed on data — such as obtaining, recording, storing, retaining, modifying, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by wholly or partly automated means or by non-automated means as part of any data filing system — is regarded as the processing of personal data.
Personal data is processed in compliance with the procedures and principles provided for in the relevant legislation. Paribu Biletleme processes personal data, in line with the general principles, in compliance with the law and the rule of good faith, accurately and, where necessary, up to date, for specified, explicit and legitimate purposes, in a connected, limited and proportionate manner with the purpose for which they are processed, and on the condition that they are retained for the period provided for in the relevant legislation or necessary for the purposes for which they are processed. Except in the situations specified as exceptions in the Law, the Company processes personal data with the explicit consent of the data subject. The Company may process personal data and special categories of personal data without explicit consent in the exceptional cases provided for in Articles 5 and 6 of the Law.
5.2.1. Processing of Personal Data
Paribu Biletleme carries out its personal data processing activities in compliance with the data processing conditions set out in Article 5 of the Law. Except in the following cases, the Company obtains the explicit consent of the relevant person.
Express Provision in the Laws: Where expressly provided for in the laws, the personal data of the relevant person may be processed lawfully without the explicit consent of the person being obtained. (For example, the receipt of invoice information for the payment processes of a person purchasing a ticket from Paribu Biletleme.)
Where It Is Mandatory for the Protection of the Life or Bodily Integrity of the Person Themselves or Another Person Who Is Unable to Express Their Consent Due to Actual Impossibility or Whose Consent Is Not Granted Legal Validity: If the relevant person is unable to express their consent due to actual impossibility, or if the processing of personal data is mandatory for the protection of the life or bodily integrity of the person themselves or another person to whom legal validity cannot be granted, personal data may be processed without the person's explicit consent being obtained. (For example, taking a visitor who is feeling unwell within the Company premises to the medical office and recording their contact information.)
Where the Processing of Personal Data of the Parties to a Contract Is Necessary, Provided That It Is Directly Related to the Establishment or Performance of the Contract: Where the processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract by Paribu Biletleme, personal data of the relevant person may be processed without their explicit consent being obtained. (For example, the receipt of contact information so that ticket details can be sent to a person purchasing a ticket from Paribu Biletleme.)
Where It Is Mandatory for Our Company to Fulfil Its Legal Obligation: Where the processing is mandatory for Paribu Biletleme to fulfil its legal obligations, personal data of the relevant person may be processed without their explicit consent being obtained. (For example, responding to questions asked by public institutions and sending the requested documents.)
Where the Personal Data Has Been Made Public by the Relevant Person Themselves: Where the personal data has been made public by the relevant person themselves, personal data may be processed without explicit consent being obtained. (For example, contacting an authorised person whose corporate email address is published on a corporate website.)
Where the Processing of Data Is Mandatory for the Establishment, Exercise or Protection of a Right: Where data processing is mandatory for the establishment, exercise or protection of a right, personal data of the relevant person may be processed without their explicit consent being obtained. (For example, the processing of personal data so that Paribu Biletleme's legal rights can be exercised in a possible dispute.)
Where Data Processing Is Mandatory for the Legitimate Interests of Paribu Biletleme: Where data processing is mandatory for the legitimate interests of Paribu Biletleme, provided that it does not harm the fundamental rights and freedoms of the relevant person, personal data of the relevant person may be processed without their explicit consent being obtained. (For example, the recording of camera footage within the Company premises for the purpose of ensuring security, in such a way as not to violate the fundamental rights and freedoms of persons within the premises.)
One or more personal data processing conditions that render a personal data processing activity lawful may apply at the same time.
5.2.2. Processing of Special Categories of Personal Data
Within the scope of the Personal Data Protection Law, certain categories of data — which are accepted as more sensitive than other data — are subject to certain special protection rules and special measures that must be taken. In particular, personal data that, when processed unlawfully, carries the risk of causing aggrievement of persons and/or discrimination is determined as "special category" in Article 6 of the Law. This data includes data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
Paribu Biletleme carries out the processing activity of personal data designated as a special category in compliance with the data processing conditions set out in Article 6 of the Law. In the processing of special categories of personal data, the adequate measures determined by the Board are also taken.
The processing of special categories of personal data is, as a rule, prohibited. However, provided that the adequate measures determined by the Board are taken, the special categories of personal data of the relevant person may be processed in the following cases:
The existence of the explicit consent of the relevant person
Express provision in the laws
Where it is mandatory for the protection of the life or bodily integrity of the person themselves or another person who is unable to express their consent due to actual impossibility or whose consent is not granted legal validity
Where it relates to personal data made public by the relevant person and is in line with the will to make it public
Where it is mandatory for the establishment, exercise or protection of a right
Where it is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and for the planning, management and financing of health services, by persons under the obligation of professional secrecy or by authorised institutions and organisations
Where it is mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance
Where it is intended for the existing or former members and affiliates of foundations, associations and other non-profit organisations or formations established for political, philosophical, religious or trade union purposes, or for persons in regular contact with these organisations and formations, in compliance with the legislation to which they are subject and their purposes, limited to their fields of activity, and provided that they are not disclosed to third parties
5.2.3. Categories of Personal Data Processed by Paribu Biletleme
The personal data obtained within Paribu Biletleme is used in line with different data processing purposes within the scope of the Company's operations. For this reason, the personal data we collect varies depending on our data processing purpose. The personal data processed is also indicated in the privacy notices we use in the data collection channels specific to the process. The categories of personal data we generally process in our processes are indicated in the table below:
Identity Data: Name and surname, mother's and father's name, mother's maiden surname, date of birth, place of birth, marital status, ID card serial number, Turkish ID number, etc.
Contact Data: Address number, email address, contact address, registered electronic mail address (KEP), telephone number, etc.
Location Data: Location data of where the person is, etc.
Personnel Data: Payroll information, disciplinary investigations, recruitment document records, CV information, performance evaluation reports, etc.
Legal Action Data: Information in correspondence with judicial authorities, information in case files, etc.
Customer Transaction Data: Call centre records, invoice, request information, etc.
Physical Premises Security Data: Entry/exit records of employees and visitors, camera recordings, etc.
Transaction Security Data: IP address information, website entry/exit information, password information, etc.
Risk Management Data: Information processed for the management of commercial, technical and administrative risks, etc.
Financial Data: Balance sheet information, financial performance information, credit and risk information, asset information, etc.
Professional Experience Data: Diploma information, courses attended, in-service training information, certificates, transcript information, etc.
Marketing Data: Transaction history information, surveys, cookie records, information obtained through campaign work, etc.
Visual and Audio Recordings: Visual and audio recordings, etc.
Health Information: Information relating to disability status, personal health information, etc.
Criminal Conviction and Security Measures Data: Information regarding criminal convictions, information regarding security measures, etc.
Other Information: Power of attorney information, driving licence information, etc.
5.3. Protection of Personal Data
Paribu Biletleme, in accordance with Article 12 of the Law, takes all necessary technical and administrative measures to ensure the appropriate security level for the prevention of the unlawful processing of, and unlawful access to, the personal data it processes, and for the retention of personal data.
5.3.1. Technical and Administrative Measures Taken Within the Company
Paribu Biletleme implements the following technical and administrative measures specified by the Personal Data Protection Authority:
Network security and application security are ensured.
A closed-system network is used for personal data transfers via the network.
Key management is implemented.
Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
The security of personal data stored in the cloud is ensured.
Disciplinary regulations containing data security provisions for employees are in place.
Training and awareness activities are carried out for employees on data security at certain intervals.
An authority matrix has been established for employees.
Access logs are kept regularly.
Corporate policies on access, information security, use, retention and destruction have been prepared and put into practice.
Data masking measures are applied where necessary.
Confidentiality undertakings are made.
The authorities in this area of employees who change roles or leave employment are removed.
Up-to-date anti-virus systems are used.
Firewalls are used.
Signed contracts contain data security provisions.
For personal data transferred via paper, additional security measures are taken and the relevant documents are sent in confidential document format.
Personal data security policies and procedures have been determined.
Personal data security issues are reported quickly.
Personal data security is monitored.
The necessary security measures are taken for entry to and exit from physical environments containing personal data.
The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
The security of environments containing personal data is ensured.
Personal data is reduced as much as possible.
Personal data is backed up and the security of the backed-up personal data is also ensured.
A user account management and authority control system is implemented and monitored.
Periodic and/or random in-house audits are carried out and caused to be carried out.
Log records are kept in such a way that there is no user intervention.
Existing risks and threats have been identified.
Protocols and procedures relating to the security of special categories of personal data have been determined and are implemented.
Special categories of personal data, if to be sent via email, are sent in encrypted form and using KEP or a corporate email account.
Secure encryption / cryptographic keys are used for special categories of personal data and are managed by different units.
Intrusion detection and prevention systems are used.
Penetration testing is carried out.
Cybersecurity measures have been taken and their implementation is continuously monitored.
Encryption is carried out.
Special categories of personal data transferred via portable memory, CDs or DVDs are transferred in encrypted form.
Periodic audits of data-processing service providers on data security are ensured.
Awareness of data-processing service providers regarding data security is ensured.
Data loss prevention software is used.
5.3.2. Measures to Be Taken in the Event of Unlawful Disclosure of Personal Data
In the event that the processed personal data is obtained by others through unlawful means, the Company will notify the relevant person and the Board as soon as possible.
6. Retention of Personal Data
6.1. Purposes of Processing Personal Data
Paribu Biletleme processes your personal data in line with the purposes necessary for the fulfilment of its obligations and activities arising from all relevant national/international legislation and the secondary regulations published in line therewith by national/international authorities — in particular the Law No. 6563 on the Regulation of Electronic Commerce, the Law No. 6502 on the Protection of the Consumer, the Labour Law No. 4857 and the Turkish Commercial Code No. 6102 — as well as from all contracts to which it is a party. Your personal data is processed in accordance with the principles set out in Article 4 of the Law and the conditions regulated in Articles 5 and 6, in order for us to carry out our activities and fulfil our obligations.
Detailed information regarding which personal data Paribu Biletleme processes for what purpose and on what legal grounds it relies is also included in the privacy notices provided at the stage when personal data is collected.
6.2. Personal Data Retention Periods
Paribu Biletleme first determines whether a period is provided for the retention of personal data in the relevant legislation. If a period is provided for in the relevant legislation, this period is complied with; if no period is provided for, personal data is retained for as long as necessary for the purpose for which they are processed. Where the purpose of processing of personal data has ended and the retention periods set by the relevant legislation and/or our Company have come to an end, the data may be retained throughout the limitation periods set out in the laws solely for the purpose of constituting evidence in possible legal disputes, asserting the right associated with the personal data or establishing a defence.
7. Destruction of Personal Data
In the event that the reasons requiring the processing of personal data have ceased, the personal data will be deleted, destroyed or anonymised, ex officio or at the request of the data subject, under the conditions relating to the destruction methods set out in the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, published in the Official Gazette dated 28.10.2017 and numbered 30224, and in this Policy.
In respect of the processes for the deletion, destruction and anonymisation of personal data;
In the event that a service is being received from a third-party service provider such as a cloud storage service provider, the deletion of the data held in the records of such service provider is carried out by checking whether the service provider has the authority (technical possibility) to recover the data,
The data held on data recording devices is stored in encrypted form and is deletable,
Personal data on paper is, where possible, shredded; where this is not possible, it is rendered illegible by hatching/painting/erasing using fixed ink, in such a way that it cannot be reversed and cannot be read by technological solutions,
Office files held on the central server are deleted using the deletion command in the operating system, or the access rights of the relevant user to the file or the directory in which the file is located are removed,
The relevant rows containing personal data in databases are deleted using database commands (DELETE, etc.),
Where, in respect of destruction, mere deletion from records is not sufficient, operations such as breaking into pieces too small to be understood, destruction of copies of encryption keys, and rendering the recording media irreversible by means of methods such as de-magnetisation, physical deformation or overwriting are carried out,
The data is destroyed or the storage environment in which the data is processed is dismantled,
In respect of anonymisation, measures are taken such as: rendering the data such that it cannot be associated with the relevant person by removing or modifying all direct and/or indirect identifiers; using anonymisation methods that, depending on the specific situation, do not provide value irregularity (removal of variables/records, regional concealment, generalisation, lower and upper bound coding, sampling) or that do provide it (micro-aggregation, data swapping, addition of noise); or using statistical methods (K-Anonymity, L-Diversity, T-Closeness).
The right of Paribu Biletleme not to fulfil the request of the relevant person in cases where it has the right and/or obligation to retain personal data under the provisions of the relevant legislation is reserved.
7.1. Periodic Destruction Periods
Pursuant to Article 7 of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, personal data that has been processed in compliance with the legislation but in respect of which the reasons requiring its processing have ceased, or in respect of which the period provided for in the legislation has expired, is destroyed periodically.
Pursuant to Article 11 of the relevant Regulation, the periodic destruction operation is carried out following the completion of the periodic destruction period determined by Paribu Biletleme.
8. Transfer of Personal Data to Third Parties
The personal data and special categories of personal data of the data subject may be transferred within the scope of the processing purposes. Within the scope of processing activities by Paribu Biletleme, personal data may be shared with third parties from whom the Company receives services, authorised institutions and organisations, lawyers for the resolution of legal disputes, natural and legal persons with whom we are in a relationship of agency, customers, our business partners and the group of companies of which Paribu Biletleme is a member. Except in cases of exception, personal data may not be transferred without the explicit consent of the relevant person.
In line with the provisions set out under both the Constitution and the Personal Data Protection Law No. 6698, Paribu Biletleme exercises the utmost care and attention regarding the sharing of personal data domestically and/or abroad, and within this scope conducts its activities in compliance with the existing regulations. Paribu Biletleme may transfer personal data to third parties in Türkiye, and may also transfer it abroad — including for outsourcing purposes — for processing in Türkiye or for processing and retention abroad, in compliance with the conditions provided for in the Law and other relevant legislation, taking all security measures specified in the legislation; unless otherwise provided in the contract signed electronically with the relevant person and other relevant legislation.
The personal data that is required to be transferred legally by Paribu Biletleme may be transferred to the necessary administrative and official authorities, and to programme partner institutions and organisations with which there is cooperation. In addition, it may be transferred to third parties from whom we receive support in areas such as the call centre and payroll, due to legal obligations or within the scope of the conduct of our activities and within the framework of legal limitations. It may be transferred, to the extent required by the work, to other third parties from whom we receive services such as the establishment, development and maintenance of the technical and administrative infrastructure and electronic systems (the website), the maintenance of customer data, and the management of call centre processes.
8.1. Transfer of Personal Data Domestically
In compliance with Article 8 of the Law, the transfer of personal data domestically will be possible provided that it complies with the conditions set out in the section of this Policy entitled "Processing of Personal Data".
Within the scope of the data types specified in this Policy and the purposes set out in the privacy notices, our Company carries out transfers to third parties (companies affiliated with Paribu Biletleme Teknolojileri Anonim Şirketi, business partners, employees, subcontractors or suppliers, service provider companies, public institutions and legally authorised private persons or organisations) in line with the purpose of processing of the data and provided that the necessary security measures are taken. Personal data transfers carried out within this scope take place via the secure environments and channels offered by the relevant third party.
8.2. Transfer of Personal Data Abroad
In compliance with Article 9 of the Law, the transfer of personal data abroad cannot, as a rule, be carried out without the explicit consent of the person whose data is processed. Our Company carries out transfers abroad in line with the purpose of processing of the data and provided that the necessary security measures are taken. The transfer of personal data abroad is carried out in line with the conditions set out in Article 9 of the Law. Our Company also obtains consent from the data subject by means of an explicit consent statement directed at the transfer where necessary regarding transfers abroad. The personal data processed by Paribu Biletleme may be transferred to electronic environments such as servers, hosting companies, programmes and cloud computing located abroad from which information technology support is received for archiving and storage purposes, taking the necessary security measures, and may be subject to processing activity and stored there.
The personal data subject to the domestic and foreign transfers set out above is also legally protected by the technical measures to ensure their security, as well as by the provisions in our legal documents in compliance with the Personal Data Protection Law, taking into account whether the counterparty in the legal relationship is a data controller or a data processor.
When personal data is transferred to countries outside Türkiye during the sharing of information as set out above, the data is ensured to be transferred in accordance with this policy and as permitted by the law applicable to data protection.
8.3. Groups of Persons to Whom Personal Data Is Transferred
Our Company may transfer personal data within the scope of this Policy, in compliance with Articles 8 and 9 of the Law, to the following groups of persons domestically and abroad, within the framework of the purposes specified:
Natural persons or private law legal persons
Shareholders
Business partners
Affiliates and subsidiaries
Suppliers
Authorised public institutions and organisations
9. Disclosure Obligation
The Company informs relevant persons during the obtaining of personal data, in compliance with Article 10 of the Law. Within this scope, during the obtaining of their personal data, relevant persons are provided with disclosures regarding the identity of the Company, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of personal data collection, and the rights of the data subject under Article 11 of the Law. The Company provides the necessary information where the relevant person requests information, in compliance with Article 11 of the Law.
In addition, in cases where the explicit consent of the relevant persons is required for the processing of personal data, in order to obtain the consent of the relevant persons regarding a specific subject, declared with free will, information is also provided regarding the matters for which explicit consent is requested.
Paribu Biletleme provides information to relevant persons and ensures transparency in personal data processing activities by announcing — in particular through the privacy notices prepared specific to the process, this Policy document and various other publicly available documents — that it carries out personal data processing activities in compliance with all matters in the Law and, in particular, with the rule of "compliance with law and good faith".
In addition, in the following cases, provided that they are in line with and proportionate to the purpose and fundamental principles of the Law, the Company has no disclosure obligation under Article 28 of the Law:
Where the processing of personal data is necessary for the prevention of crime or for criminal investigation,
The processing of personal data made public by the relevant person themselves,
Where the processing of personal data is necessary for the conduct of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorised public institutions and organisations and professional organisations of a public institution nature, on the basis of the authority granted by the law,
Where the processing of personal data is necessary for the protection of the economic and financial interests of the State in respect of budgetary, tax and financial matters.
10. Rights of the Data Subject
Paribu Biletleme, in compliance with Article 10 of the Law, informs the data subject of their rights and provides guidance to the data subject on how to exercise these rights. Our Company has established a team to deal with these works and operations to manage the processes regarding the protection and processing of personal data and to fulfil all other requirements of the Law. This team also works within the scope of carrying out processes regarding the protection of personal data belonging to the data subject and responding to these requests.
10.1. Right of Application
Pursuant to Article 11 of the Law, anyone whose personal data is processed may apply to our Company and request matters relating to themselves on the following:
To learn whether their personal data is processed,
To request information regarding personal data if it has been processed,
To learn the purpose of processing of their personal data and whether they are used in line with their purpose,
To know the third parties to whom their personal data is transferred domestically or abroad,
To request the correction of their personal data in the event that they have been processed incompletely or incorrectly, and to request that the operation carried out within this scope be notified to the third parties to whom the personal data has been transferred,
To request the deletion, destruction or anonymisation of their personal data in the event that the reasons requiring their processing have ceased, and to request that the operation carried out within this scope be notified to the third parties to whom the personal data has been transferred,
To object to the emergence of a result against the data subject as a result of the analysis of their processed personal data exclusively through automated systems,
To request compensation for damages in the event of suffering damage due to their personal data being processed contrary to the law.
To exercise your rights under this article, you may forward to us, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller, by one of the following methods:
By submitting a petition or by sending it via notary post to the address: Huzur Mahallesi Maslak Ayazağa Caddesi Uniq İstanbul Sitesi B Blok No: 4B Sarıyer/İstanbul,
By sending an email to the email address [email protected],
By sending it to [email protected] via Registered Electronic Mail (KEP).
Pursuant to paragraph 2 of Article 28 of the Law, in the following cases, relevant persons will not be able to assert their rights (with the exception of the right to request compensation for damages):
Where the processing of personal data is necessary for the prevention of crime or for criminal investigation,
The processing of personal data made public by the relevant person themselves,
Where the processing of personal data is necessary for the conduct of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorised public institutions and organisations and professional organisations of a public institution nature, on the basis of the authority granted by the law,
Where the processing of personal data is necessary for the protection of the economic and financial interests of the State in respect of budgetary, tax and financial matters.
10.2. Response to Application
Paribu Biletleme, in compliance with Article 13 of the Law, will finalise free of charge the application requests made by the relevant person as soon as possible and at the latest within 30 (thirty) days, depending on the nature of the request. However, where the operation also requires a cost, the fee in the tariff determined by the Board may be charged. Where the application arises from a fault of the data controller, the fee charged is refunded to the relevant person.
It should be assessed that the application of the relevant person may be rejected in the following cases:
Where it would impede the rights and freedoms of other persons,
Where it requires disproportionate effort,
Where the information is publicly available,
Where it would endanger the privacy of others,
Where one of the cases falling outside the scope under the Law is present.
10.3. Explanations Regarding Camera Recordings
Camera monitoring is carried out within our Company premises for the purpose of protecting the interests of Paribu Biletleme and other persons in ensuring security.
In line with the regulations contained in the Law, this Policy is published on our website by Paribu Biletleme regarding the camera monitoring activity, and a notification text indicating that monitoring is being carried out is posted at the entrances of the areas where monitoring is carried out.
Image recordings are taken via security cameras within our Company premises by means of a camera monitoring system at the entrances of the Company building and facility and within the facility.
There is no monitoring in areas where there may be a result of intrusion into the privacy of the person. Only a limited number of our Company employees and, where necessary, employees of the security company in the position of supplier may access the security camera recordings. The said persons who have access to the recordings declare that they will protect the confidentiality of the data they access by means of the confidentiality undertaking they sign.
11. Effectiveness
All rights of this document, including but not limited to intellectual property rights, belong to Paribu Biletleme Teknolojileri A.Ş.
This Policy is updated in line with legal requirements or as needed. Changes made within this scope are immediately incorporated into the text.
Related articles
Paribu Kripto Varlık Alım Satım Platformu A.Ş. Customer Explicit Consent Statement
I have been informed about my personal data processed through the "Customer Privacy Notice of Paribu Kripto Varlık Alım Satım Platformu Anonim Şirketi" prepared by Paribu Kripto Varlık Alım Satım Platformu A.Ş. ("Paribu" or the "Company") within the scope of the membership and identity verification procedures of customers and pursuant to the Personal Data Protection Law No. 6698 ("Law").
I consent to the processing of the data obtained within the scope of the process of completing membership and identity verification procedures — including name and surname, date of birth, place of birth, Turkish ID number or Foreign ID number, ID card number and ID card serial number (if I use the old-type identity card), copies of the front and back of the Turkish ID card or Foreign ID card, nationality information, mother's name, father's name, civil registry sample (where required), telephone number, email, province, district and full address of residence, residence certificate, support centre records, receipt information, request/complaint information, lost/stolen and notice reports, information regarding the transactions I have carried out via the Paribu website, including buy/sell orders/transactions, assessment information, photograph, recording of the meeting held with the customer during a video call, voice recordings of conversations with the call centre, IP address, hardware model, device operating system and version, device type, device ID, user transaction records, website access logs and log records, bank information, IBAN, bank customer number, correspondence with judicial authorities, information regarding case/enforcement files in the event of a dispute, signature, facial recognition information (identification data used during the remote identification (video call process) to verify that the user is the same person as the biometric photograph on the Turkish ID card or Foreign ID card), biometric photograph on the Turkish ID card or Foreign ID card, occupation information, my average monthly income, my main source of income, location information (location data of where I am), and signature circular (if I am a legal person user representative) — for the following purposes:
Provision of the products and services offered under the best conditions,
Reliable and uninterrupted provision of the products or services offered,
Maximisation of customer satisfaction,
Carrying out of various procedures relating to the said services and the conduct and development of operations,
Carrying out of financial transactions,
Carrying out of promotional, marketing, advertising, campaign and survey activities relating to the said products and services or to different products and services,
Fulfilment of the requirements of the contracts entered into with users.
I consent to the processing, within the scope of the granting of ancillary rights and benefits to Paribu users, of the name and surname, telephone number, email address and location information obtained, for the following purposes:
Establishing communication for the purpose of sending commercial electronic messages to users,
Enabling participation in campaigns and events specially organised for Paribu users,
Benefitting from gifts and benefits prepared for Paribu users.
I also consent to the transfer of such data to service provider companies, business partners and group companies of Paribu located domestically and abroad, in compliance with the rules on the transfer of personal data set out in Articles 8 and 9 of the Law.
Note from Paribu Kripto Varlık Alım Satım Platformu Anonim Şirketi: If you wish to access more detailed information regarding the protection and processing of personal data within Paribu, to withdraw your consent or to exercise your rights under the Law, you may access more detailed information at "www.paribu.com".
Author:
Paribu
