XKOREN ENERJİ INC.
CLARIFICATION TEXT REGARDING PERSONAL DATA PROCESSING
Definitions
XKoren Enerji Incorporated (“Company”) aims to process the personal data of the data subjects according to the provisions of the Personal Data Protection Law No. 6698 (“KVK Law”) and other legislations.
Since you are a data subject to our Company, we hereby inform you that your personal data you have declared/will declare to our Company or obtained by our Company externally or in any manner whatsoever will be processed by our Company in the capacity of “Data Controller”,
• Within the framework of the purpose that requires your personal data to be processed and in connection with, within the limits and to the extent of such purpose,
• By maintaining the accuracy and the latest version of the personal data that have been declared to our Company,
• Thus they will be recorded, stored, retained, rearranged, shared with the institutions authorized to request such personal data and under the conditions stipulated by the KVK Law, they may be conveyed, transferred to domestic or foreign third parties, classified and they may be processed in the manners listed in the KVK Law and may be subjected to other processes listed in the KVK Law.
Within this scope, according to the Laws and Regulations on the protection of the fundamental rights and freedoms of individuals, particularly the privacy of private life, and to protect personal data, our Company takes all technical and administrative measures to ensure the provision of required security level to prevent unlawful processing of your personal data, to prevent unlawful access and to ensure its protection.
By means of the Clarification Text, it has been adopted to continue and develop the activities carried out by the Company accordinmg to the principles in the KVK Law.
The following terms mentioned in this clarification text will have the meanings next to them;
Personal Data: Any information related to an identified or identifiable natural person,
Personal Data Protection Law (“KVKK”): Personal Data Protection Law No. 6698, which was published in the Official Gazette on April 7, 2016,
Data Processor: The natural or legal person who processes Personal Data on behalf of the data controller, based on the authority given by the data controller.,
Data Controller: The natural or legal person who determines the purposes and means of processing Personal Data and is responsible for the establishment and management of the data recording system.
Data Subject: The natural person whose personal data is processed.
The Parties Whose Data Are Collected
Within the scope of the Personal Data Protection Law, we collect the data of the parties listed below who have a business relationship with our company. These are;
• Our employees and employee candidates
• Family members and relatives of our employees and employee candidates,,
• Our customers,
• Our suppliers,
• Our consultants,
• Our business partners,
• Our company officials,
• Our company representatives,
• Person(s) with whom we have a contractual relationship and their employees
• Person(s) who are the addressee of legal proceedings,
• Survey participants,
• Our visitors,
The Data of the Data Subjects Collected and Processed by Our Company
Within the scope of Articles 5 and 6 of the Personal Data Protection Law, the following data are collected and processed by our Company. These are;
• Identity and contact information,
• Family and social life information,
• Education and training information,
• Employment information,
• Information on request/complaint management,
• Information on legal affairs,
• Financial information,
• Audit information,
• Electronic media usage information,
• Information on goods and services supplied and provided,
• Business activities information,
• Location information,
• Information on trade and other licenses and permits,
• Physical location security information,
• Visual and auditory information (photo, camera),
• Telecommunication records,
• E-mail and information systems services usage records,
• Login records,
• Cookie records
• Health reports and health information,
• Criminal record information
Data Collection Purposes of Our Company
Within the scope of Articles 5 and 6 of the Personal Data Protection Law, we collect and process data for the company purposes listed below in a manner to be limited to such purposes. These are;
• Realization of our company's commercial activities.
• Carrying out business processes related to commercial activities,
• Management and execution of relations with business partners and/or suppliers,
• Technical management of our company's websites,
• Customer management and follow-up of complaints,
• Product surveys and follow-up of questions you may send to our company,
• Carrying out the necessary work by our business units to benefit you from the products and services offered by our company,
• Planning and execution of sales, marketing and after-sales processes of products and/or services,
• Providing information about the contents of products and services,
• Sending commercial electronic messages by obtaining separate approval in accordance with the legal legislation,
• Execution of events and other organizations,
• Execution of legal and commercial relations with our Company and people who have business relations with our Company and ensuring the security of these relations,
• Administrative operations for the communications carried out by our company,
• Employee administration and management,
• nsuring the physical security and control of the company locations,
• Planning the logistics activities,
• Carrying out reputation research processes,
• Compliance with ethical values and law, and execution of legal business and procedures,
• Follow-up of agreement processes and/or legal requests,
• Planning and executing Human Resources and personnel recruitment processes, and monitoring and realizing education and training activities,
• Planning and/or execution of occupational health and/or safety processes,
• Providing our Company to benefit from incentives by conducting research and development activities,
• Planning and execution of corporate communication and corporate governance activities,
• Execution of information security management services,
• Carrying out activities aimed at monitoring and auditing finance and/or accounting works and determining the financial risks of customers,
• Determination and implementation of our company's commercial and business strategies,
• Entry and follow-up of visitor records,
• For the purpose(s) to be notified to the data subject at the time of acquisition of information
• Ensuring the fulfilment of legal obligations as required or imposed by the relevant legislation,
Transfer of the Data Collected by Our Company In Line With the Respective Purposes
Your personal data, that may be collected by our company within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Personal Data Protection Law, may be shared with our affiliates, shareholders, business partners (only anonymously), legally authorised public institutions and private individuals and other persons within the scope of our purposes detailed above.
Method of Collection of the Data Collected by Our Company and Legal Grounds
Personal data are being collected, used, recorded, stored and processed within the framework of principle of proportionality provided that they are in connection and limited to the legal purposes explicitly stated above according to the law and good faith, by informing verbally, in writing and/or electronically and, if necessary, verbally, in writing and/or electronically upon explicit consent.
We hereby assure you that your personal data will not be processed by our company other than for the purposes specified in this clarification text.
Retention Period of the Data Collected by Our Company
Your personal data will retained during the retention periods specified in the respective legal regulations, or, if no period is determined in the said regulations, according to the practices of our Company and the practices of commercial life or for the period required by the aforementioned processing purposes. After the end of the respective period, these data will be deleted, destroyed or removed from our Company's data streams by anonymization methods according Article 7 of the Personal Data Protection Law.
Security of Your Data Collected and Processed by Our Company
Your personal data that you share with our company may be collected verbally, in writing or electronically through automatic or non-automatic methods, offices, branches, call centres, website, social media channels, mobile applications and similar means. Your personal data will be stored in electronic and/or physical media. The requirements of the Personal Data Security Guidelines published by the KVKK Board are constantly being practised and developed within the scope of continuous improvement to prevent your personal data provided and stored by our company from being exposed to unauthorised access, manipulation, loss and damage in the environments where they are retained.
Rights of Data Subject whose Data is Collected and Processed
According to Article 11 of the Personal Data Protection Law, Each person has the right to request to the data controller about him/her;
a) to learn whether his/her personal data are processed or not,
b) to demand for information as to if his/her personal data have been processed,
c) to learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose,
ç) to know the third parties to whom his personal data are transferred in country or abroad,
d) to request the rectification of the incomplete or inaccurate data, if any,
e) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,
f) to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,
g) to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
ğ) to claim compensation for the damage arising from the unlawful processing of his/her personal data.
The cases where data subjects do not have the right to claim has been listed under Paragraph 2 of Article 28 of the Law, and within this context personal data processing must be;
a) necessary for the prevention of committing a crime or for crime investigation.,
b) carried out on the data which are made public by the data subject himself/herself,
c) necessary for performance of supervision or regulatory duties and disciplinary investigation and prosecution to be carried out by the assigned and authorised public institutions and organizations and by public professional organizations, in accordance with the power conferred on them by the law,
d) necessary for protection economic and financial interests of State related to budget, tax and financial matters.
According to paragraph 1 of Article 28 of the same Law, since they would be out of the scope of Law, the requests of the data subject will not be taken into consideration where:
a) personal data are processed by natural persons within the scope of purely personal activities of the data subject or of family members living together with him/her in the same dwelling provided that it is not to be disclosed to third parties and the obligations about data security is to be complied with.
b) personal data are processed for official statistics and provided that they are being anonymized for the purposes for such as research, planning and statistics.
c) personal data are processed with artistic, historical, literary or scientific purposes, or within the scope of freedom of expression provided that national defence, national security, public security, public order, economic security, right to privacy or personal rights are not violated or the process does not constitute a crime.
d) personal data are processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorised and assigned by law to maintain national defence, national security, public security, public order or economic security.
e) personal data are processed by judicial authorities or execution authorities with regard to investigation, prosecution, judicial or execution proceedings.
Application Methods Within the Framework of the Rights of Data Subject
Pursuant to Paragraph 1 of Article 13 of the Personal Data Protection Law, you may extend your requests related to your aforementioned rights through the following methods and information based on the “Application Methods and Principles to the Data Controller” published in the Official Gazette No: 30356, Dated March 10th, 2018.
Information Required for Application;
1. Name and Last Name of the Applicant.
2. TR ID No of the Applicant if the Applicant is a citizen of the Republic of Turkey; if not, Nationality and Passport Number and, if any, the ID Number.
3. Correspondence address or office address of the Applicant.
4. Correspondence e-mail address, phone or faximile number of the Applicant.
5. Subject of request of the Applicant.
6. Information and documents regarding the subject of request of the Applicant.
Application Methods;
1. The Applicant may extend a request by personally submitting a filled out Personal Data Request Application Form in a closed envelope on which the inscription “Information Request Pursuant to Personal Data Protection Law” is written, to the information desk at the activity address of XKOREN (Orhangazi Mh. 1656. Sk. No:19 34538 Esenyurt/İstanbul), against a delivery report.
2. The Applicant may send a notice to the activity address of XKOREN (Orhangazi Mh. 1656. Sk. No:19 34538 Esenyurt/İstanbul) through a Notary Public, but the inscription “Information Request Pursuant to Personal Data Protection Law” must be written on the envelope.
3. The Applicant may personally submit an application to the Registered Electronic Mail address of our company info@xkoren.com.tr by using a “Secure Electronic Signature” defined in the Electronic Signature Law No 5070 and including the inscription “Information Request Pursuant to Personal Data Protection Law” in the subject area.
You can find our application form here regarding your rights described above.