KVKK and Information Text

SEGMENT COMPUTER FOREIGN TRADE JOINT STOCK COMPANY

PERSONAL DATA PROTECTION AND PROCESSING POLICY

 

This Personal Data Protection and Processing Policy has been prepared by Segment Bilgisayar Dış Ticaret Anonim Şirketi ( the " Company ") within the framework of Law No. 6698 on the Protection of Personal Data. It provides information about our company's procedures and principles regarding the processing and transfer of personal data shared or generated by the User with the Company during the use of the content on the Company's official website, www.rampage.com.tr (the " Website"), by users, visitors, members, and other persons ("User or Related Person"). Based on these principles and procedures, as the Company, we take all administrative and technical measures in line with our policy for the protection and processing of Personal Data.

1. Purpose of the Personal Data Protection and Processing Policy:

 

The purpose of the Personal Data Protection and Processing Policy (“ Policy ”) is, …………. [AST1] Our company, which carries out the processing of personal data, the protection of this data and the destruction of it when necessary, is subject to the Personal Data Protection Law No. 6698. Our aim is to regulate the principles and guidelines our company has determined within the scope specified within this framework. It should also be noted that, within this scope, our aim is to protect the fundamental rights and freedoms of individuals to the maximum extent, especially the right to privacy as stipulated in Article 20 of the Constitution, and to inform Personal Data Owners about our Company's obligations and the procedures and principles it will implement pursuant to Law No. 6698 on the Protection of Personal Data. The primary and most important objective of our policy is to protect the privacy of Personal Data Owners and the security of their data.

2. Scope of the Personal Data Protection and Processing Policy:

 

This Policy applies to certain company beneficiaries, provided that they consist of real persons existing within the company, and to other classes and provided that they are new real persons that can be obtained from outside the company;

 Company Shareholders,

 Company Business Partners,

 Company Officials,

 Company Employees,

 Company Interns,

 Former Employees of the Company,

 Employee Candidates,

 Visitors,

 Company Customers,

 Potential Customers,

 It has been prepared for Third Parties and will be applied to all real persons except those specified.

The Company publishes this Policy on the website www.segment.com.tr in accordance with the Personal Data Protection Law No. 6698. As we have stated above, this Policy applies to legal entities, regardless of their title or name. In addition, the "Personal Data Processing Policy for Employees" will be applied to our company employees.

This Policy applies to the above mentioned real persons, in accordance with the Personal Data Protection Law No. 6698 of our Company. within the scope of This Policy will apply if Personal Data is processed entirely or partially by automated means, or non-automated means provided that it is part of any data recording system. This Policy will not apply if the data does not fall within the scope of " Personal Data " as defined below, or if our Company does not process Personal Data through the means specified above.

3. Definitions within the Scope of Personal Data Protection Law No. 6698:

 

The main definitions to be used in the application of the Law while implementing this Policy by our Company are;

 

 

4. Enforcement of the Personal Data Protection and Processing Policy:

 

Organized by Segment Computer Foreign Trade Joint Stock Company and published on the Company's website www.rampage.com.tr It is made available to the relevant persons upon request of Personal Data Owners from the date of publication.

5. Protection of Personal Data within the Scope of Our Company Policy:

 

1. Security of Personal Data;

Our Company takes all necessary technical and administrative measures to prevent unlawful processing and access of Personal Data and to ensure the appropriate level of security in order to ensure the preservation of Personal Data in accordance with the Personal Data Protection Law No. 6698.

2. Control;

Our company carries out and has the necessary audits carried out to ensure the establishment of data security and the regularity and continuity of the measures taken as described above. .

3. Security;

Our Company takes all necessary technical and administrative measures, taking into account technological possibilities and implementation costs, to ensure that relevant data controllers and data processors do not disclose their Personal Data to others in violation of the Law and Policy, or use it for purposes other than those intended. In this context, we are conducting information and training programs regarding the Law and Policy with our Company employees.

4. Unauthorized Disclosure of Personal Data;

If Personal Data processed by our Company is obtained by others through unlawful means, our Company will take the necessary steps to notify the relevant Personal Data Owner and the Personal Data Protection Board as soon as possible. If deemed necessary by the Personal Data Protection Board, this situation may be announced on the Personal Data Protection Board's website or by another method deemed appropriate by the Board.

5. Observing the Legal Rights of Personal Data Owners;

Our Company observes all legal rights of Personal Data Owners through the implementation of the Policy and the Law and takes all necessary measures to protect these rights.

6. Protection of Special Personal Data;

As stated in the definitions section, data related to a person's race, ethnicity, political views, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data are considered Special Personal Data. Our Company considers that Special Personal Data, if learned by others, could cause the relevant person to be victimized or subjected to discrimination. Therefore, all necessary measures are meticulously taken to protect such personal data processed in accordance with the law.

6. General Principles in the Processing of Personal Data within the Scope of Our Company Policy:

Our Company processes Personal Data in accordance with Personal Data Protection Law No. 6698 and the procedures and principles stipulated in this Policy. Our Company acts within the framework of the following principles when processing Personal Data.

1. The Principle of Compliance with the Rules of Law and the Rule of Honesty;

 

Our Company processes personal data in accordance with the principle of integrity in the most comprehensive manner, taking into account both private law and customary law within the scope of the Personal Data Protection Law No. 6698 and the regulations attached to this law, and uses the data meticulously and duly within these limits.

2. The Principle of Being Accurate and Up-to-Date ;

 

Our Company ensures that the Personal Data it processes is accurate and up-to-date, taking into account the fundamental rights and legitimate interests of Personal Data Owners. In this context, we carefully consider such issues as identifying the sources from which the data was obtained, verifying its accuracy, and assessing whether it needs to be updated.

3. The Principle of Processing for Identifiable, Clear and Legitimate Purposes;

 

Our Company clearly and precisely determines the purpose of data processing and ensures that this purpose is legitimate. A legitimate purpose means that the Personal Data processed by our Company is relevant to and necessary for the business it performs or the service it offers.

4. The Principle of Being Relevant, Limited and Proportionate to the Purpose for Which They Are Processed;

 

Our Company ensures that the Personal Data processed is suitable for achieving the designated purposes and avoids processing Personal Data that is not relevant or necessary to achieve the purpose. To process data to meet potential needs that may arise later, it complies with one of the Personal Data processing requirements stipulated in the Law, as if it were processing for the first time. Furthermore, it limits the data processed to only what is necessary to achieve the purpose.

5. The principle of preservation for the period stipulated in the relevant law or necessary for the purpose for which they are processed;

 

If applicable legislation specifies a data retention period, our Company complies with these periods; otherwise, we retain Personal Data only for the period necessary for the purpose for which it is processed. If there is no valid reason for our Company to retain Personal Data any longer, the data in question will be deleted, destroyed, or anonymized.

7. Conditions for Processing Personal Data Within the Scope of Our Company Policy:

 

Our Company does not process Personal Data without the explicit consent of the data owner. Our Company may process Personal Data without the explicit consent of the data owner if one of the following conditions is met.

1. If Explicitly Provided in Relevant Laws

 

Our Company may process Personal Data of Personal Data Owners in cases expressly prescribed by law, even without explicit consent.

2. In case it is necessary for a person who is unable to express his consent due to physical impossibility or whose consent is not recognized as legally valid to protect his own life or the bodily integrity of another person;

 

Our Company may process Personal Data without explicit consent to protect individuals' life or physical integrity in cases where consent cannot be disclosed or is not valid. Personal Data of the Data Subject may be processed during medical interventions to protect the individual's life or physical integrity. In this context, data such as blood type, past illnesses and surgeries, and medications used may be processed through the relevant healthcare system.

3. In case the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract;

 

Personal Data may be processed by our company in connection with the establishment or performance of a contract.

4. In case it is mandatory for the data controller to fulfill his legal obligations;

 

If our company requests and discloses personal data from official institutions and organizations in order to resolve or clarify an incident, the data controller may share the requested personal data in order to fulfill its legal obligation.

 

 

5. It has been made public by the relevant person himself;

 

Our Company may process the Personal Data of the Personal Data Owners that have been made public by them, in other words, disclosed to the public in any way, as it is deemed that the legal interest to be protected is eliminated in the processing of such data that has been made public by the Personal Data Owners and thus has become known to everyone.

6. Data Processing is Necessary for the Establishment, Exercise or Protection of a Right;

 

In cases where data processing is necessary for the establishment, exercise or protection of a right, the personal data of the data subjects may be processed without seeking explicit consent.

 

7. Data Processing is Necessary for the Legitimate Interests of the Data Controller, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Subject;

 

Our Company may process Personal Data of Personal Data Subjects in cases where processing is necessary to ensure its legitimate interests, provided that it does not prejudice the fundamental rights and freedoms of Personal Data Subjects protected under the Law and Policy. Our Company demonstrates due diligence in complying with the fundamental principles of Personal Data protection and in maintaining a balance between the interests of our Company and Personal Data Subjects.

8. Conditions for Processing Special Personal Data within the Scope of Our Company Policy;

 

Our Company does not process Special Personal Data without the explicit consent of the data subject. However, Personal Data other than those related to health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law. Personal Data related to health and sexual life is processed by our Company only for the purposes of protecting public health, providing preventive medicine, providing medical diagnosis, treatment, and care services, and planning and managing healthcare services and financing, and without seeking the explicit consent of the data subject under conditions where we are subject to a confidentiality obligation. In this regard, our Company meticulously implements the necessary monitoring process and any measures and requirements that may be taken by our Company to implement adequate measures determined by the Board in the processing of Special Personal Data.

9. Deletion, Destruction or Anonymization of Personal Data within the Scope of Our Company Policy:

Although our Company has processed personal data in accordance with the Law and other relevant legal provisions, if the reasons requiring processing no longer exist, personal data will be deleted, destroyed, or anonymized by the data controller, either ex officio or upon the request of the relevant person. The provisions of other laws regarding the deletion, destruction, or anonymization of personal data are reserved. The procedures and principles regarding the deletion, destruction, or anonymization of personal data are governed by regulations.

10. Transfer of Personal Data Within the Scope of Our Company Policy:

 

 If it is necessary to protect the life or physical integrity of the Personal Data owner or someone else and the Personal Data owner is unable to give his consent due to actual impossibility or his consent is not legally valid,

 If it is necessary to transfer Personal Data belonging to the parties to a contract, provided that it is directly related to the establishment or execution of a contract,

 If the transfer of Personal Data is mandatory for our Company to fulfill its legal obligations,

 If the Personal Data has been made public by the Personal Data owner,

 If the transfer of Personal Data is mandatory for the establishment, exercise or protection of a right,

 Personal Data may be transferred if it is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the Personal Data owner.

11. Transfer of Personal Data Abroad Within the Scope of Our Company Policy:

 

Our Company may transfer Personal Data and Special Personal Data of Personal Data Subjects to third parties abroad by taking the necessary security measures in line with the purposes for which it processes Personal Data. To this end, taking into account the matters listed in the relevant law, our Company may transfer Personal Data to foreign countries declared by the Personal Data Protection Board to have adequate protection, or, if insufficient protection is not available, to foreign countries where the data controllers in Türkiye and the relevant foreign country have undertaken, in writing, to provide adequate protection and where the Personal Data Protection Board has granted its approval. Countries with these qualifications will be declared by the Personal Data Protection Board.

12. Classification of Personal Data Within the Scope of Our Company Policy:

 

Our Company processes Personal Data by classifying it within a set of definitions in accordance with Personal Data Protection Law No. 6698. Explanations regarding these classes are listed below.

1. Personal Data Owner's Identity Information

 

Personal data is data related to the identity of the data owner. These data;

 Name-surname,

 Turkish ID number,

 Marital status,

 Nationality information,

 Name and surname of parents,

 Place and date of birth,

 Gender

 Driving license,

 Identity card

 Passport

 Tax number,

 Social Security number,

 Signature information,

 Vehicle license plate and other information are included.

 

2. Contact Information of the Personal Data Owner;

Personal data is data related to the identity of the data owner. These data;

 Telephone number,

 Address,

 Email address,

 Fax number,

 IP address and other information are included.

3. Transaction Security Information of the Personal Data Owner;

These are personal data processed regarding the technical, administrative, legal and commercial security of both the Personal Data Owner and the Company during the operations carried out by the Company in its internal and external operations.

4. Financial Information of the Personal Data Owner;

These are information and documents showing all kinds of financial results arising from the employee-employer relationship that the Company has established with the Personal Data owner. In addition;

 Personal data processed regarding the records,

 Bank account number,

 Branch code,

 Bank card information,

 IBAN number,

 Credit card information,

 Financial profile,

 Credit score,

 Asset data,

 It includes income information and other information.

5. Visual and Audio Information of the Personal Data Owner;

 

Photographs and camera recordings, sound recordings, and any data and other information containing these data.

6. Personal Data  Owner's Personal Information;

 

These are all kinds of personal data processed to obtain information that will form the basis for the protection of personal rights of real persons who are in a business relationship with the Personal Data Owner.

7. Location Information of the Personal Data Owner;

Information that determines the location of the Personal Data owner while using Company vehicles by the Personal Data owner within the framework of the activities and operations of the Company or the companies and institutions it cooperates with; GPS location, travel data and other information.

8. Information about the Personal Data Owner's Family Members and Relatives;

 

Identity and contact information, as defined above, about the family members (e.g. spouse, mother, father, child), relatives and other persons who can be reached in emergency situations within the framework of the activities and operations of the Company or the companies and institutions it cooperates with or in order to protect the legal and other interests of the Company and the Personal Data owner.

9. Personal Data Owner's Physical Location Security Information;

 

Personal data regarding records and documents taken upon entry to the physical location and during stay in the physical location;

 Camera recordings,

 Fingerprint records

 Records and other data taken at the security point.

10. Legal Procedure Information of the Personal Data Owner;

 

These are the data processed within the scope of the determination and follow-up of the Company's legal receivables and rights, the fulfillment of its debts and its legal obligations.

11. Personal Data  Owner's Special Personal Information;

 

These are the data specified in Article 6 of the Personal Data Protection Law No. 6698. (Health data, biometric data, religion and association membership information, etc.)

12. Request/Complaint Management Information of the Personal Data Owner;

These are data related to the Personal Data owner regarding the receipt and evaluation of any request or complaint directed to our Company.

13. Purposes of Processing Personal Data Within the Scope of Our Company Policy:

In order to fulfill the obligation to inform in Article 10 of the Personal Data Protection Law No. 6698, our Company provides information to data owners about the purposes for which Personal Data will be processed, to whom and for what purpose the processed data can be transferred.

Your personal data is processed within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law, limited to the purposes of optimally planning and implementing our human resources policies, accurately planning and executing our commercial partnerships and strategies, ensuring the legal, commercial and physical security of our Company and our business partners, ensuring the corporate functioning of our Company, working to ensure that you benefit most from the products and services offered by our Company, customizing the products and services offered by our Company according to your demands, needs and requests and recommending them to you, ensuring the highest level of data security, creating databases , improving the services offered on our Company's website, communicating with those who submit their requests and complaints to our Company, and correcting errors that occur on our Company's website .

14. Purposes of Transferring Personal Data Within the Scope of Our Company Policy:

 

Personal Data owner's data is transferred within the scope of the conditions specified in Articles 8 and 9 of the Law, limited to the purposes of optimally planning and implementing our human resources policies, accurately planning and executing our commercial partnerships and strategies, ensuring the legal, commercial and physical security of our Company and our business partners, ensuring the corporate functioning of our Company, carrying out studies to ensure that you benefit most from the products and services offered by our Company, customizing the products and services offered by our Company according to your demands, needs and requests and recommending them to you, ensuring the highest level of data security, creating databases, improving the services offered on our Company's website, communicating with those who submit their requests and complaints to our Company, and correcting errors that occur on our Company's website .

15. Persons to Whom Personal Data Will Be Transferred Within the Scope of Our Company Policy

 

Data of the Personal Data owner;

 To our shareholders,

 To our business partners,

 To our suppliers,

 To our affiliates,

 To the companies and institutions we cooperate with,

 It may be transferred to companies from which our company receives external services (in matters such as security, health, occupational safety, law, etc.) and authorized institutions and organizations in order to fulfill our contractual or legal obligations.

 

16. Personal Data Collection Method and Legal Reasons Within the Scope of Our Company Policy

 

For the purpose of auditing the compliance with Article 1, which regulates the purpose of the Law on the Protection of Personal Data No. 6698, and Article 2, which regulates the scope of the law, Personal Data;

 All kinds of verbal,

 Written,

 In electronic environment, through technical and other methods,

 Call center, Our company website,

 Various ways such as mobile applications,

 Legislation to achieve the objectives set out in the policy,

 Contract,

 It is collected in order to fulfill the responsibilities arising from the law completely and correctly within the framework of legal reasons based on demand and request.

Following these collection methods, the data is processed by our Company or data processors commissioned by our Company.

17. Deletion, Destruction or Anonymization of Personal Data within the Scope of Our Company Policy:

 

Without prejudice to the provisions of other laws regarding the deletion, destruction or anonymization of Personal Data, our Company deletes, destroys or anonymizes Personal Data ex officio or upon the request of the data owner, in case the reasons requiring processing are eliminated, even though it has processed the Personal Data in accordance with the Personal Data Protection Law No. 6698 and other legal provisions.

Deleting personal data means destroying it in a way that it cannot be used or retrieved in any way. This means that personal data is irreversibly deleted from any media such as documents, files, CDs, floppy disks, or hard drives on which it is stored.

Destruction of Personal Data means destroying data storage materials such as documents, files, CDs, floppy disks and hard disks in which the data is recorded, in a way that the information cannot be retrieved or used again.

By anonymizing data, it is meant that Personal Data cannot be associated with an identified or identifiable natural person, even if matched with other data.

18. Storage Period of Personal Data Within the Scope of Our Company Policy:

 

Our Company stores Personal Data in accordance with the periods stipulated in Personal Data Protection Law No. 6698 and other legislation. If there is no specific period regulation in Personal Data Protection Law No. 6698 or other legislation regarding the period for which Personal Data must be stored, Personal Data is processed for a period of time until the activity carried out when our Company processes that Personal Data is fulfilled for the purpose of processing the Personal Data, and then it is deleted, destroyed, or anonymized.

 

19. Informing the Owner of Personal Data Within the Scope of Our Company Policy:

 

Our Company provides information to Personal Data Subjects when collecting personal data, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data. In this context, information is provided regarding the identity of the Company representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis for collecting personal data, and the rights of the Personal Data Subject.

20. Rights of Personal Data Owners in Accordance with the KVKK Law within the Scope of Our Company Policy:

 

Our company informs everyone of their rights pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data; provides guidance on how to exercise these rights; and implements the necessary internal operational, administrative, and technical regulations for all of these purposes. Pursuant to Article 11 of the Law, our company provides the following to individuals whose personal data is collected:

 Learning whether personal data is being processed,

 To request information regarding the processing of personal data,

 To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

 To know the third parties to whom personal data is transferred, either domestically or abroad,

 To request correction of personal data if it is processed incompletely or incorrectly,

 Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,

 To request that the transactions carried out in accordance with subparagraphs (d) and (e) of Article 11 of the Law be notified to third parties to whom personal data has been transferred,

 To object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

 Explains that they have the right to demand compensation in case of damages due to unlawful processing of personal data.

You may submit your requests regarding the implementation of the Personal Data Protection Law No. 6698 to the Personal Data Protection Law Data Owner Application You can submit your requests to our Company in writing using the form , with a secure electronic signature, or by sending them to the address provided in the application form using other methods determined by the Personal Data Protection Board (" Board "). Our Company will process your requests free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the process requires additional costs, a fee may be charged according to the tariff determined by the Board.

Our Company may accept or reject the request, explaining the reason, and will notify the relevant person in writing or electronically. If the request in the application is accepted, our Company will take appropriate action. If the application is due to a mistake on our part, the fee will be refunded to the data subject.

In cases where the application is rejected, the response is found insufficient or the application is not responded to in a timely manner, the data owner has the right to lodge a complaint with the Board within thirty days from the date on which he/she learns of the response and, in any case, within sixty days from the date of application.

21. Cases where the Policy and Law will not be fully or partially applied within the scope of our Company Policy:

 

This Company Policy and the provisions of the Law will not apply in the following cases:

 Personal data shall be processed by natural persons within the scope of activities related to themselves or their family members living in the same residence, provided that they are not disclosed to third parties and that data security obligations are complied with.

 Processing of personal data for purposes such as research, planning and statistics by making them anonymous with official statistics.

 Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, privacy of private life or personal rights or does not constitute a crime.

 Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.

 Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.

Provided that it is in accordance with and proportionate to the purpose and fundamental principles of this Policy and the Law No. 6698 on the Protection of Personal Data, Article 10, which regulates the data controller's obligation to inform, Article 11, which regulates the rights of the data subject, excluding the right to demand compensation for damages, and Article 16, which regulates the obligation to register with the Data Controllers Registry, shall not apply in the following cases.

 Personal data processing is necessary for the prevention of crime or criminal investigation.

 Processing of personal data made public by the relevant person.

 Personal data processing is necessary for the execution of supervisory or regulatory duties or disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations with public institution status, based on the authority granted by law.

 Personal data processing is necessary to protect the economic and financial interests of the State regarding budget, tax and financial matters.

22. Classification of Personal Data Owners within the Scope of Our Company Policy :

 

Only natural persons can benefit from the protection of this Policy and the Law; Personal Data Owners within this scope are grouped as follows:

23. Matching Personal Data with Personal Data Owners within the Scope of Our Company Policy:

 

The mapping of the classified Personal Data, the definitions and scopes of which are given above, to the classified Personal Data Owners is presented below.