Özsüt | Ustalıkla Hazırlanan Enfes Lezzetler

Protection of Personal Data

1. Protection of Personal Data

As per the Law on the Protection of Personal Data No. 6698 (“KVKK”), personal data means any information relating to an identified or identifiable natural person. The following statement has been drafted to notify you about the processing of your personal information stored at STP Gıda Sanayi ve Ticaret Anonim Şirketi (“Company”), which is registered at Kemalpaşa Tax Office with tax ID no. 7810450262 and MERSİS no. 0781045026200016 and located at Kemalpaşa Osb Mahallesi İzmir Ankara Asfaltı Cadde No: 51/ Kemalpaşa İzmir), including the reasons for such processing, the legal basis, data collection methods, to whom and for what purposes your data may be transferred, and the rights granted to you in connection with or independent of such processes under KVKK.

2. Legal reasons and methods for the collection of personal data

As the data controller, the Company is authorized to utilize the bonton.com.tr contact form to process and transfer personal data for the objectives outlined in Articles (3) and (4) of this Privacy Notice, in compliance with the personal data processing requirements and objectives specified in Articles 5 and 6 of the Law No. 6698.

Data Category	Description	Purpose for Processing Data	Legal Basis
ID	: Name, Surname	Follow-up of Requests / Complaints	The creation and execution of a contract and it is expressly stipulated in the law
Contact	: E-mail, telephone number	Follow-up of Requests / Complaints	The creation and execution of a contract and it is stipulated in the law
Processing Security	: Online traffic information, IP Address Information, Website Entry and Exit Information, Password and Password Information if membership is available Computer Screen Recordings, Device IMEI Number, Device MAC Address	Carrying out Activities in Adherence to the Laws, Providing Information to Authorized Individuals, Institutions, and Organizations, and Implementing Information Security Procedures	It is expressly stipulated in the law
Message Content	: Any information relating to an identified or identifiable natural person provided in the message section of the Contact Form	Follow-up of Requests / Complaints	The creation and execution of a contract, legal obligation of the data controller
Video and Audio Recordings	: Call center audio recordings	Follow-up of Requests / Complaints	The creation and execution of a contract, legal obligation of the data controller
Location	: Location information	Execution of Activities in Compliance with the Legislation, Authorized Person, Institution It is clearly stipulated in the law, Data controller must process such information to fulfill their legal obligation, provided that it does not harm the fundamental rights and freedoms of the Data subject, processing of such data is mandatory for the legitimate interests of the data controller

In cases where explicit consent is required in as per the relevant articles, your explicit consent may be obtained. Nevertheless, processing personal data without obtaining the relevant individual's consent may be permissible, provided that the conditions stipulated in paragraph 2 of Article 5 are met. To comply with mandatory laws, it is crucial to ensure that the information of natural persons is accurate and kept up-to-date. For this reason, you may be requested to update your personal information at certain intervals.

3. Duration

If there is any record of electronic commerce information processed by our company, our company is required by Law No. 6563 to store your call center voice recordings for 3 (three) years, your online traffic information for 2 (two) years under Law No. 5651, and other personal data for 1 (one) year. If a legal relationship ends, your personal data is stored for 10 (ten) years from the end of the legal relationship. Once the specified time period is over, the Company will delete, destroy, or anonymize your personal data, or do so upon your request, in accordance with the Law on the Protection of Personal Data and relevant regulations. You have the right to withdraw your consent for personal data processing, except for cases where processing falls under the conditions outlined in Article 5/2 of relevant legislation.

4. Transfer of Personal Data and Purposes of Transfer

For the purpose of addressing requests and complaints, our company may transfer your identity, customer transaction, and communication data to our call center and dealers, provided that the necessary measures are taken to comply with contractual and legal obligations as the data controller. Data requested from us shall be shared with authorized public institutions, organizations, and judicial authorities to fulfill our obligations to provide information to aforementioned institutions, organizations and authorities, and other related obligations, and for the purposes of exercising our legal rights, such as the rights of action and reply.

5. Rights of the Data Subject Listed in Article 11 of the KVKK (“Law”)

If you submit to us a request regarding your rights as a person whose personal data are processed by our Company, our Company shall resolve the request free of charge as soon as possible depending on the nature of the request and in no later than 30 (thirty) days. However, if the request necessitates an additional cost, our Company shall charge the data subject as per the fees determined by the Personal Data Protection Authority. In line with Article 11 of the Law No. 6698, data subjects have the right to;

● Learn whether their personal data are processed or not,

Demand for information as to if their personal data have been processed,
Learn the purpose of the processing of their personal data and whether these personal data are used in compliance with the purpose,
Know the third parties to whom his personal data are transferred in country or abroad,
Request rectification in case their personal data are processed incompletely or inaccurately and request notification of the operations carried out accordingly to third parties to whom their personal data have been transferred,
Request the deletion or destruction of personal data in the event that the reasons necessitating their processing cease to exist, even though they are processed in accordance Law no. 6698 or relevant others laws, and request notification of the operations carried out accordingly to third parties to whom the personal data have been transferred,
Object to occurrence of any result that is to their detriment by means of analysis of personal data exclusively through automated systems,
Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data.
If you submit to us your request for exercising your rights specified in Article 11 of the Law No. 6698 as per the “Communiqué on the Principles and Procedures for the Request to Data Controller” by filling out the Request Form on our website and by means of hand delivery, KEP (registered electronic mail), mail or your e-mail address already registered with us, your request shall be evaluated and resolved as soon as possible and in no later than 30 (thirty) days.
It is mandatory for requests to include name, surname, signature (if the request is submitted in written form), TR ID number (if the data subject is a Turkish citizen), and nationality, passport number / ID (if the data subject is a foreigner), place of residence or workplace address for notification, e-mail address, telephone or fax number for notification, if any, and the subject of the request.
The company may require further confirmation to confirm your identity and safeguard your rights, based on the nature and mode of delivery of your request.

6. Exceptions to the Right to Request

Pursuant to Article 28 of KVKK, data subjects shall not be able to exercise their rights if;

• Personal data are processed for official statistics and provided that they are being anonymized for purposes such as research, planning and statistics

• Personal data are processed for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that national defense, national security, public security, public order, economic security, right to privacy or personal rights are not violated or the process does not constitute a crime

• Personal data are processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorized and assigned by law to ensure national defense, national security, public security, public order or economic security

• Personal data are processed by judicial authorities or execution authorities with regard to investigation, prosecution, judicial or execution proceedings Pursuant to Article 28/2 of KVKK, data subjects shall not be able to exercise their rights, excluding the right to claim compensation, if personal data processing is:

• Necessary for the prevention of committing a crime or for crime investigation • Carried out on the data which are made public by the data subject themselves.

• Necessary for performance of supervision or regulatory duties and disciplinary investigation and prosecution to be carried out by the assigned and authorized public institutions and organizations and by public professional organizations, in accordance with the power conferred on them by the law

• Necessary for the protection of economic and financial interests of the State related to budget, tax and financial matters