Personal Data Protection Policy

BULKOON FOOTWEAR AND LEATHER PRODUCTS INDUSTRY TRADE LIMITED COMPANY DATA PROTECTION AND PROCESSING POLICY 

Personal Data Protection and Processing Policy

According to the provision in Article 20 of the Constitution of the Republic of Turkey, everyone has the right to demand the protection of their personal data. This right includes being informed about personal data concerning oneself, accessing such data, requesting correction or deletion, and learning whether the data is used in accordance with its purposes.

The Personal Data Protection Law No. 6698 ("Law"), published in the Official Gazette on 07.04.2016 and effective thereafter, regulates the protection of fundamental rights and freedoms of individuals in the processing of personal data, as well as the obligations and procedures to be followed by real and legal persons processing personal data. The purpose of this Policy prepared in this context is to ensure compliance with the obligations set forth by the Law.

This document contains the declarations and explanations of BULKOON FOOTWEAR AND LEATHER PRODUCTS INDUSTRY TRADE LIMITED COMPANY ("Company") regarding the processing of personal data of real persons other than our employees, primarily customers and other third parties, within the scope of the Law.

Our Company reserves the right to make changes to the Policy to provide up-to-date information about our personal data protection practices and legal regulations. In case of substantial changes to the Policy, Data Subjects will be informed through various channels.

Definitions related to the concepts used within this Policy are provided below, taking into account the personal data protection legislation.

1. Definitions

1. Principles Regarding Data Privacy

According to Article 3 of the Law, any operation performed on personal data, whether fully or partially by automated means or not, including obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making accessible, classifying, or preventing the use of such data, is considered processing of personal data. Our Company acts in accordance with the general principles explained below within the scope of Personal Data Processing activities.

Compliance with lawfulness and fairness: Our Company conducts personal data processing activities in compliance with the Constitution, the Personal Data Protection Law, and relevant legislation, in accordance with lawful and fairness principles.

Accuracy and up-to-dateness: Our Company provides Data Subjects the opportunity to update their personal data and takes necessary measures to ensure accurate transfer of data to databases.

Processing for specific, explicit, and legitimate purposes: Our Company limits personal data processing activities to specific and legitimate purposes and clearly informs Data Subjects about these purposes through disclosure texts.

Processing limited, relevant, and proportionate to the purpose: Personal data is processed by our Company only to the extent necessary and relevant to the purpose notified to the Data Subject at the time of collection.

Retention for the period prescribed by relevant legislation or necessary for the purpose: Our Company retains personal data only for the period prescribed by the Law and relevant legislation or as required for the data processing purposes. After these periods expire, data is deleted, destroyed, or anonymized in accordance with our Company’s procedures.

1. Conditions for Processing Personal Data

Except for the explicit consent of the personal data owner, the basis for personal data processing may be one or more of the conditions listed below. If the processed data is special category personal data, the related conditions below will apply.

(i) Explicit Consent of the Data Subject

One of the conditions for processing personal data is the explicit consent of the data subject, which must be freely given based on being informed about a specific subject.

If any of the following conditions exist, personal data may be processed without the explicit consent of the data subject.

(ii) Explicit Provision in Laws

If the personal data of the data subject is explicitly provided for in the law, meaning there is a clear provision regarding the processing of personal data in the relevant law, this condition is considered fulfilled.

(iii) Impossibility of Obtaining Consent Due to Actual Impossibility

If the person whose consent cannot be obtained due to actual impossibility or whose consent is not legally valid, and processing personal data is mandatory to protect the life or physical integrity of the person or another person, personal data may be processed.

(iv) Direct Relation to the Establishment or Performance of a Contract

If the processing of personal data is necessary for the establishment or performance of a contract to which the data subject is a party, this condition is considered fulfilled.

(v) Fulfillment of Our Company’s Legal Obligation

If processing is mandatory for our Company to fulfill its legal obligations, personal data may be processed.

(vi) Public Disclosure by the Data Subject

If the data subject has publicly disclosed their personal data, such data may be processed limited to the purpose of public disclosure.

(vii) Necessity for Establishing or Protecting a Right

If processing is necessary for the establishment, exercise, or protection of a right, personal data may be processed.

(viii) Necessity for the Legitimate Interests of Our Company

Provided that it does not harm the fundamental rights and freedoms of the data subject, personal data may be processed if necessary for the legitimate interests of our Company.

a. Processing of Special Categories of Personal Data

Special categories of personal data may be processed by our Company without explicit consent, in accordance with the principles stated in this Policy and with all necessary administrative and technical measures including methods determined by the Board, under the following conditions. Outside these conditions, explicit consent of the data subject will be obtained:

(i) Explicitly provided for in laws,

(ii) Mandatory for protecting the life or physical integrity of the person or another person when the data subject cannot express consent due to actual impossibility or consent is not legally valid,

(iii) Related to personal data publicly disclosed by the relevant person and in accordance with their disclosure will,

(iv) Necessary for establishing, exercising, or protecting a right,

(v) Necessary for persons under confidentiality obligations or authorized institutions and organizations for public health protection, preventive medicine, medical diagnosis, treatment and care services, and planning, management, and financing of health services,

(vi) Necessary for fulfilling legal obligations in employment, occupational health and safety, social security, social services, and social assistance,

(vii) For foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, provided they comply with their legislation and purposes, limited to their activity areas, not disclosed to third parties, and directed to current or former members or those regularly in contact with these organizations,

Informing the Data Subject

Our Company informs data subjects in accordance with Article 10 of the Law and secondary legislation about who the data controller is, the purposes of processing, with whom and for what purposes personal data is shared, the methods of collection, the legal basis, and the rights of data subjects regarding their personal data processing.

1. Personal Data Collected

The personal data collected by our Company varies according to the nature of the relationship with our Company and legal obligations.

The personal data collected may include but is not limited to:

• Identity Information: Name, Surname, and Turkish ID Number,

• Contact Information: Phone number, Address, and other contact details,

• Location: Location data of the place where the person is located, etc.,

• Legal Transaction Information: Information in correspondence with judicial authorities, case file information, etc.,

• Customer Transaction Information: Call center records, invoices, order information, request and complaint management information (information and records collected regarding requests and complaints related to products and services associated with the person and reports evaluated by relevant departments),

• Transaction Security: IP address information, website access logs, password and credential information, etc.,

• Risk Management: Information processed for managing commercial, technical, and administrative risks, etc.,

• Finance: Balance sheet information, financial performance data, credit and risk information, asset information, etc.,

• Marketing: Shopping history, surveys, cookie records, information obtained through campaign activities, etc.

The types of personal data listed do not cover all data processed; similar types of personal data may also be processed by our Company.

1. Purposes of Personal Data Processing

Your personal data obtained may be processed by our Company in compliance with the conditions set forth in Articles 5 and 6 of the Law and for the following purposes:

1. Retention of Personal Data

Our Company determines the retention periods of personal data by considering applicable legislation and the purposes for which the data is processed. Legal obligations and statute of limitations related to personal data processing activities are always taken into account. When the purpose of personal data processing ceases to exist, data is deleted, destroyed, or anonymized unless there is another legal reason or basis allowing retention. Detailed information on this subject can be found in the PERSONAL DATA RETENTION AND DESTRUCTION POLICY available at https://bulkoon.com/veri-imha-politikasi.

1. Transfer of Personal Data

Your personal data may be shared within the scope of the above purposes and in accordance with the personal data transfer conditions set out in Articles 8 and 9 of Law No. 6698, as shown in the table below. In cases where your personal data is shared, our Company takes necessary measures to ensure that the receiving party processes and transfers the data in compliance with this Policy and applicable legislation.

Your personal data may also be transferred in cases such as partial or complete change of ownership of our Company through share sales, mergers, divisions, or changes in legal entity type. In such cases, necessary steps will be taken to ensure the receiving party complies with the processing and transfer rules set forth in this Policy.

Transfer of your personal data abroad is only possible under the following conditions:

• If the conditions stipulated in Article 9 of the Law exist, namely;

  • If one of the exceptions explained above in Articles 5 and 6 of the Law applies without explicit consent and there is an adequacy decision regarding the country to which the transfer will be made, or;

  • If there is no adequacy decision regarding the country of transfer, but the exceptions in Articles 5 and 6 of the Law are met, and there is an opportunity for individuals to exercise their rights and effective legal remedies in those countries, and a standard contract is signed with the receiving party;

  • If neither of the above conditions is met, transfer may be made temporarily with your explicit consent.

1. Data Security

Our Company takes reasonable technical and administrative measures to prevent unauthorized access risks, accidental data loss, intentional deletion, or damage to your personal data. Detailed information on this subject can be found in the PERSONAL DATA RETENTION AND DESTRUCTION POLICY.

1. Rights of Data Subjects

According to Article 11 of the Law, Data Subjects have the following rights against the Data Controller:

• To learn whether personal data concerning themselves is processed and to request information if processed.

• To learn the purpose of processing personal data and whether it is used accordingly.

• To know the third parties to whom personal data is transferred domestically or abroad.

• To request correction of incomplete or inaccurate personal data.

• To request deletion or destruction of personal data within the scope of applicable conditions and to request notification of such actions to third parties to whom the data was transferred.

• To object to the emergence of a result against themselves by analyzing processed data exclusively through automated systems.

• To claim compensation for damages in case of unlawful processing of personal data.

Article 28, paragraph 2 of the Law lists cases where data subjects do not have the right to request, including:

• Processing of personal data necessary for prevention of crime or investigation of crime,

• Processing of personal data publicly disclosed by the relevant person,

• Processing of personal data by authorized public institutions and professional organizations with public institution status for supervision, regulation, disciplinary investigation or prosecution based on the authority granted by law,

• Processing of personal data necessary for protecting the economic and financial interests of the State regarding budget, tax, and financial matters,

In these cases, except for the right to claim compensation for damages, the rights listed above cannot be exercised.

Exercising Rights by Data Subjects

You have rights to effectively exercise these rights. To do so, you can submit your request including necessary identity information, other requested information, and explanations regarding the right you wish to exercise under Article 11 of the Law, by filling out the form at https://bulkoon.com/veri-sahibi-basvuru-formu. You may deliver the signed copy of the form along with identity documents in person to AKÇABURGAZ MAH. 3027. SK. NO: 1 F ESENYURT/ISTANBUL, send it by registered mail, through a notary, or by other methods specified in the Law. Alternatively, you can send the form with a secure electronic signature to ___________@___.kep.tr. Your request will be concluded as soon as possible and no later than 30 (thirty) days. If the process requires an additional fee, the tariff determined by the Personal Data Protection Board will be charged.

Our Company may request additional information from the relevant person to verify whether the applicant is the Data Subject and may ask questions to clarify the application.