GDPR Compliance – Montregard: Your Data Rights

GDPR / KVKK

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA (MEMBER/POTENTIAL CUSTOMER)

In accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure, we, MONTREGARD (hereinafter referred to as the “Data Controller”), would like to inform and enlighten you about the personal data processing activities we carry out.

1. Purpose, Method, and Legal Basis for Processing Your Personal Data

Your personal data (name, surname, email address, phone number) will be processed in accordance with KVKK, other relevant legislation, and the Data Controller’s Personal Data Protection and Processing Policy for the purposes of conducting/monitoring business activities, conducting communication activities, managing sales processes of goods/services, managing marketing processes of goods/services, managing post-sales processes of goods/services, conducting finance and accounting operations, and carrying out legal affairs. This will be done using methods employed in hard disks, servers, and electronic environments, either automatically or non-automatically, verbally, in writing, or electronically, in accordance with the provisions of Articles 5 and 6 of the KVKK; based on the legal obligations to be fulfilled, provisions in laws, establishment, use, or protection of a right, and the legitimate interests of the data controller.

The following principles are adhered to in the processing of personal data:

• Compliance with law and honesty,
• Accuracy and, when necessary, up-to-dateness,
• Processing for specific, explicit, and legitimate purposes,
• Being related to, limited, and proportionate to the purposes for which they are processed,
• Retention for the period stipulated in the relevant legislation or necessary for the purposes for which they are processed.

For detailed information regarding the purposes of processing your personal data, you can access the Personal Data Protection and Processing Policy and the Personal Data Retention and Destruction Policy available on our website at www.montregard.com.tr.

1. Transfer of Personal Data

Your personal data may be processed, recorded, stored, classified, updated, and, in cases permitted by law or limited to the purposes for which they are processed, transferred to the following domestic and foreign recipient groups, with your knowledge and within the limits prescribed by KVKK and relevant legislation.

Below are the domestic and international recipient groups along with the purposes of data transfer.

In the domestic context, data may be transferred to the groups below based on contractual, auditing, and legal obligation reasons.

Domestic Recipient Groups:

• Authorized Public Institutions and Organizations
• Infrastructure suppliers in the technology sector

There is no transfer of data abroad.

Additionally, with your approval, email and SMS communications may be sent to you by our Company in accordance with the procedures and principles set forth in the Regulation on Commercial Communications and Commercial Electronic Communications.

1. Security of Personal Data

As the Data Controller, we are obliged to ensure your data security under the Personal Data Protection Law No. 6698. Therefore:

• To prevent the unlawful processing of personal data,
• To prevent unauthorized access to personal data,
• To ensure the protection of personal data,

We take all necessary technical and administrative measures to ensure an appropriate level of security for these purposes. Additionally, we conduct and ensure necessary audits within our institution or organization to implement the provisions of this Law. We do not disclose, share, transfer, expose, or use personal data we process in violation of the KVKK and other relevant legislation for purposes other than the original intent of processing.

1. Your Rights Under Article 11 of the KVKK

For all your requests, you can fill out the ‘Data Subject Application Form’ available on our website at www.montregard.com.tr or send your application document prepared by yourself through the channels specified below. Your applications made to us under Article 11 of the KVKK will be responded to and concluded within a maximum of 30 days.

The rights you have under the aforementioned article are as follows:

• To learn whether your personal data is being processed by the data controller and request information related to it.
• To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose.
• To request the correction of your personal data if it has been processed incompletely or inaccurately.
• To request the deletion or destruction of your personal data under the conditions stipulated in Article 7 of the KVKK.
• To request notification to third parties to whom your personal data has been transferred regarding the transactions made in accordance with Articles 11 (d) and (e) of the KVKK.
• The right to appeal if your personal data is analyzed exclusively through automated systems, resulting in an outcome against you.
• The right to request compensation for any damage you may suffer due to the unlawful processing of your personal data in violation of the relevant legislation.

You can submit a signed copy of the requests related to the exercise of the above-mentioned rights along with identification documents in person to the following address: Göktürk/İSTANBUL. Alternatively, you can send your request via notary or other methods specified in the KVKK, or you can email the application form to info@montregard.com 

Thank you for reading the clarification text.

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA (CUSTOMER)

In accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure, we, MONTREGARD (hereinafter referred to as the “Data Controller”), would like to inform and enlighten you about the personal data processing activities we carry out.

1. Purpose, Method, and Legal Basis for Processing Your Personal Data

Your personal data (name, surname, email address, phone number, address information, Turkish ID number, credit card information, and, if you give explicit consent, profession, educational status, date of birth, gender) will be processed in accordance with KVKK, other relevant legislation, and the Data Controller’s Personal Data Protection and Processing Policy for the purposes of conducting/monitoring business activities, conducting communication activities, managing sales processes of goods/services, managing marketing processes of goods/services, managing post-sales processes of goods/services, conducting finance and accounting operations, and carrying out legal affairs. This will be done using methods employed in hard disks, servers, and electronic environments, either automatically or non-automatically, verbally, in writing, or electronically, in accordance with the provisions of Articles 5 and 6 of the KVKK; based on the legal obligations to be fulfilled, provisions in laws, establishment, use, or protection of a right, and the legitimate interests of the data controller.

The following principles are adhered to in the processing of personal data:

• Compliance with law and honesty,
• Accuracy and, when necessary, up-to-dateness,
• Processing for specific, explicit, and legitimate purposes,
• Being related to, limited, and proportionate to the purposes for which they are processed,
• Retention for the period stipulated in the relevant legislation or necessary for the purposes for which they are processed.

For detailed information regarding the purposes of processing your personal data, you can access the Personal Data Protection and Processing Policy and the Personal Data Retention and Destruction Policy available on our website at www.montregard.com.tr.

1. Transfer of Personal Data

Your personal data may be processed, recorded, stored, classified, updated, and, in cases permitted by law or limited to the purposes for which they are processed, transferred to the following domestic and foreign recipient groups, with your knowledge and within the limits prescribed by KVKK and relevant legislation. In the domestic context, data may be transferred to the groups below based on contractual, auditing, and legal obligation reasons.

Domestic Recipient Groups:

• Authorized Public Institutions and Organizations
• Infrastructure suppliers in the technology sector
• Suppliers

There is no transfer of data abroad.

Additionally, with your approval, email and SMS communications may be sent to you by our Company in accordance with the procedures and principles set forth in the Regulation on Commercial Communications and Commercial Electronic Communications.

1. Security of Personal Data

As the Data Controller, we are obliged to ensure your data security under the Personal Data Protection Law No. 6698. Therefore:

• To prevent the unlawful processing of personal data,
• To prevent unauthorized access to personal data,
• To ensure the protection of personal data,

We take all necessary technical and administrative measures to ensure an appropriate level of security for these purposes. Additionally, we conduct and ensure necessary audits within our institution or organization to implement the provisions of this Law. We do not disclose, share, transfer, expose, or use personal data we process in violation of the KVKK and other relevant legislation for purposes other than the original intent of processing.

1. Your Rights Under Article 11 of the KVKK

For all your requests, you can fill out the ‘Data Subject Application Form’ available on our website at www.montregard.com.tr or send your application document prepared by yourself through the channels specified below. Your applications made to us under Article 11 of the KVKK will be responded to and concluded within a maximum of 30 days.

The rights you have under the aforementioned article are as follows:

• To learn whether your personal data is being processed by the data controller and request information related to it.
• To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose.
• To request the correction of your personal data if it has been processed incompletely or inaccurately.
• To request the deletion or destruction of your personal data under the conditions stipulated in Article 7 of the KVKK.
• To request notification to third parties to whom your personal data has been transferred regarding the transactions made in accordance with Articles 11 (d) and (e) of the KVKK.
• The right to appeal if your personal data is analyzed exclusively through automated systems, resulting in an outcome against you.
• The right to request compensation for any damage you may suffer due to the unlawful processing of your personal data in violation of the relevant legislation.

You can submit a signed copy of the requests related to the exercise of the above-mentioned rights along with identification documents in person to the following address: Göktürk/İSTANBUL. Alternatively, you can send your request via notary or other methods specified in the KVKK, or you can email the application form to info@montregard.com 

Thank you for reading the clarification text.

COMMERCIAL COMMUNICATION AND COMMERCIAL ELECTRONIC MESSAGE APPROVAL FORM

By approving this form, I consent to the sending of all promotional, campaign, and informational messages via commercial electronic messages containing data, voice, and visual content, which are sent for commercial purposes through electronic means such as promotional and advertising activities, notifications, email, and messaging services, by MONTREGARD or through an intermediary company, in accordance with Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages published in the Official Gazette dated July 15, 2015, numbered 29417. I also agree to be contacted through these communication tools and consent to the storage and use of the information I have shared by MONTREGARD, and the retention of the content of the commercial electronic message and other related records for submission to the Ministry of Customs and Trade when necessary.

CLARIFICATION TEXT ON PROCESSING OF PERSONAL DATA

As MONTREGARD (Data Controller), which has the status of data controller under the Law No. 6698 on the Protection of Personal Data, we request your explicit consent regarding the processing of your personal data within the scope of personal data protection legislation during the membership process.

I consent to the processing and storage of my personal data shared with the Data Controller through web servers and hard disks, including my educational status, profession, date of birth, and gender, for the purposes of conducting statistical research, determining sales policies within the scope of company activities, and carrying out marketing and advertising activities. In this regard;

• I declare that I consent to the processing and storage of my personal data mentioned above shared with the Data Controller.
• I confirm that I have been informed by the Data Controller through the “Personal Data Processing Information Statement (Customer)” and that I knowingly and willingly consent to the processing, recording, and storage of my personal data in this context.

RELEVANT PERSON APPLICATION FORM

General Information

As MONTREGARD (Data Controller), we declare that we fulfill our obligations defined for data controllers in the Personal Data Protection Law No. 6698. Your personal data is processed for legal reasons and purposes specified in the Information and Clarification Texts prepared by us. The rights of the relevant persons and the methods of exercising these rights are detailed in our Information and Clarification Texts.

We would like to emphasize that, in accordance with the second paragraph of Article 14 of Law No. 6698, it is not possible to apply directly to the Authority without first applying to the data controller.

We declare that the personal information you provide to us while filling out this form must be processed by us in accordance with the reasons specified in Article 5 of Law No. 6698.

Application Subjects

The rights of the relevant persons are regulated in Article 11 of the Personal Data Protection Law No. 6698. Hereunder;

ARTICLE 11- (1) Everyone has the right to apply to the data controller to exercise the following rights related to themselves:

1. To learn whether personal data is being processed,
2. To request information regarding the processing of personal data,
3. To learn the purpose of processing personal data and whether it is used in accordance with that purpose,
4. To know the third parties to whom personal data has been transferred, either domestically or internationally,
5. To request the correction of personal data if it has been processed incompletely or incorrectly,
6. To request the deletion or destruction of personal data in accordance with the conditions specified in Article 7,
7. To request the notification of third parties to whom personal data has been transferred regarding the actions taken pursuant to paragraphs (d) and (e),
8. To contest a result that is produced against the individual as a result of the analysis of processed data solely through automated systems,
9. To request compensation for damages incurred due to the unlawful processing of personal data.

Application Methods

This form has been prepared to assist Relevant Persons in exercising their rights. It is not mandatory for Relevant Persons to use this form for their applications. In any case, the provisions specified in this form regarding identity verification and application methods will apply.

Relevant Persons;

• They can fill out this form or submit their own petition with a wet signature in person or through their representatives to the address: “Göktürk/İSTANBUL” . Identity verification is mandatory during the application process. In applications made through a representative, it is required to present a notarized copy of the power of attorney that includes the authority regarding the personal data request.
• They can send the wet-signed application form or their own prepared petition to the address in the first paragraph, with “Information Request under KVK (Personal Data Protection)” written on the envelope. The representative of the applicant can also apply by mail, along with a notarized copy of the power of attorney that includes authority regarding the personal data request.
• They can apply through a notary. The address mentioned above will also be used for applications made through a notary. The subject line of the notification should state “Information Request under KVKK (Personal Data Protection Law).’”.
• • For applications via email, they can use the address info@montregard.com. In this case, the subject line of the email must include ‘Information Request under KVK.’ Additionally, it can be sent to the kep address montregardticaret@hs09.kep.tr.

Response to Applications

Applications that meet the above conditions will be promptly answered by us. This period shall not exceed 30 days. Applications are generally free of charge; however, if the process incurs an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

The response provided by us can be personally collected by the Relevant Person with a signature or through their representative. Additionally, for proof of response, it will also be sent to the specified address or email address. The Relevant Person must determine the method of notification for the response; if no method is specified, the response will be provided using the method of the initial application. The data controller reserves the right to request additional information from the applicant.

1. CONTACT INFORMATION OF THE RELEVANT PERSON

2. YOUR RELATIONSHIP WITH THE COMPANY

 I am a visitor of the data controller.
 I am an employee of the data controller.
 I am a former employee of the data controller.

 I have received/ am receiving products and services from the data controller.

 I am a supplier, vendor, etc. who has a contractual relationship with the data controller.

 Other (Please specify) ……………..
 

3. PLEASE SELECT YOUR REQUEST UNDER ARTICLE 11 OF THE PERSONAL DATA PROTECTION LAW

(Please mark the box/boxes next to the appropriate statement regarding your request with an (X) and explain your request under the Personal Data Protection Law No. 6698 (KVKK) in detail in the section below.)

4. PLEASE SELECT THE METHOD BY WHICH THE RESULT OF YOUR APPLICATION WILL BE NOTIFIED TO YOU.

5.

This application form has been prepared to identify your relationship with the data controller and, if applicable, to fully determine the personal data processed by the data controller, ensuring that your related application can be answered correctly and within the legal time frame. In order to eliminate the legal risks that may arise from unlawful and unfair data sharing and to ensure the security of your personal data, the data controller reserves the right to request additional documents and information (such as a copy of an identity card or driver’s license) for identity and authority verification. The data controller does not accept responsibility for any claims arising from incorrect information or unauthorized applications related to the requests you provide in this form if the information is not accurate and up-to-date.