Policy of Protection of the Personal Data and Confidentiality

Web Site Confidentiality Contract

The ways of use and protection of the data related to you and the services you demand, which we obtain during your visit of this web site and use of the services that we offer you by means of this site are subjected to the conditions indicated in this “Policy of Confidentiality”. You are deemed to have accepted the conditions indicated in this “Policy of Confidentiality” upon visiting this web site and demanding to benefit from the services that we offer by means of this site.

I. Purpose of the Policy of Protection of the Personal Data and Confidentiality

Thank to for your interest in our web site. Security of the data is extremely important for us and we take all sorts of measures for protection of those data of yours. Our web site can generally be used without giving any personal data. However it may be necessary to process your personal data in the case that the products and services indicated in our web site are desired to be used through our web site.

The Law of Protection of the Personal Data #6698 (the “Law”) was put into force after being published in the Official Gazette on 7^th April 2016. The Law sets out the principles and procedures on processing of the personal data by natural persons or legal entities that are classified as the “data controller” of the personal data that determine the purposes and means of personal data processing and that are responsible for establishment and management of the data registration system.

Personal data are all data related to a natural person whose identity id definite or definable. Particularly a name, identity number, location data, an online identifier or physical, physiological, genetic, psychological, economic, cultural or social identity of a natural person could be determined directly or indirectly. On the other hand, the data controller is the natural person or legal entity, authority, institution or other body determining the purposes and means of processing personal data either alone or in cooperation with others. 

The data controllers are obligated to clarify and inform the natural persons whose data are processed while obtaining the data of the natural person. Within the scope of this obligation, the data controllers are obligated to inform the data owners on; 

ü  The identity of the data controller and his/her representative if any,

ü  The purpose of processing the personal data,

ü  To whom and for which purposes the personal data processed could be transferred,

ü  The method of and the legal reason for collecting personal data,

ü  Other rights listed in article 11 of the Law.

The subject of this Policy is the natural person and legal entity customers of our Company, the natural person authorities of the legal entity customers, its shareholders and employees, candidate customer, our group companies, natural person authorities of our business partners, its partners and employees and our candidate employees, the persons who have worked in our company either at present or in the past and the trainees, our visitors, company authorities and our partners, our business partners and candidate suppliers and such other third parties and the issues with respect to processing the personal data of the company employees are set out within the scope of the policy on protection of the personal data of employees given to the company employees in conformity with the legal legislation.

II. Scope and Amendment of the Policy of Protection and Processing Personal Data
this Policy prepared by our Company has been prepared in conformity with the Law of Protection of the Personal Data #6698. The Law has been put into force with all its provisions as of today. The data obtained from you either with your consent or as required for conformity with the law as indicated in the Law shall be used for the purpose of rendering the services that we offer of higher quality and improving the services offered to you and our quality policy. On the other certain data we have are ceased to be personal and are anonymized. Those data are such data used for statistical purposes and are not subjected to Law practice and our Policy. The Policy of Protection and Processing Personal Data of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi aims at protecting the data of our customers, candidate customers, employees and the customers and employees of the companies who work with us within solution partnership or other persons obtained automatically and contains the regulations in this respect. Our company is entitled to amend our policy and Regulation provided to be in conformity with the Law and protecting the personal data better.

III. Fundamental Rules Related to Processing Personal Data

General Principles with Respect to Processing Personal Data

In accordance with article 4 of the Law of Protection of the Personal Data, personal data should be processed on the basis of the principles and procedures indicated in the legal legislation. Within this scope the data controllers has to both fulfill the obligation of clarification and obey the following general principles indicated in article 4 of the Law of Protection of the Personal Data:

-  Being in conformity with the law and rules of honesty.

-  Being correct and updated if necessary.

-  Being processed for definite, clear and legitimate purposes.

-  Being associated with the purpose of processing, limited and moderate.

-  Being preserved for a period stipulated in the relevant legislation or necessary for the purpose of processing.

Purposes of Personal Data Processing and Transferring within the Scope of the Law

a.       Purposes of Processing Personal Data

Personal data are not processed without the data owner natural person. However in certain cases (articles 5 and 6 of the Law of Protection of the Personal Data) personal data could be processed without clear consent.

In accordance with article 5 of the Law of Protection of the Personal Data, personal data could be processed without the consent of the person whose data are processed in the case that,

                            - Data processing is clearly stipulated in the laws,

- It is compulsory to process the relevant data for protecting life or bodily integrity of any person who cannot explain his/her consent because of actual impossibility or whose consent is not recognized to be legally valid or any other person,

-Processing the personal data of the parties to the relevant contract is necessary provided to be directly related to establishment or performance of a contract,

-Processing the personal data is compulsory to enable the data controller to fulfill his/her legal obligation,

-Disclosure of the personal data by the concerned person himself/herself,

-Processing the personal data is compulsory establishment, exercise or protection of a right,

-Processing the personal data is compulsory for legitimate interest of the data controller provided not to harm the fundamental rights and freedoms of the concerned person.

Furthermore, the data related to health, sexual life, sexual preference, ethnicity, race, political thought, belief, sect, dressing, foundation or trade union membership, sentence to punishment and safety measures, which could expose the person to discrimination if they are disclosed as well as biometric and genetic data have been determined in the law as “sensitive” data and this has aggravated the conditions for processing the data. Accordingly, sensitive data could be processed under the following conditions except for the following cases where clear consent is received:

-The data related to the religion, sect or other beliefs, ethnicity, race, philosophical belief, political thought, sentence to punishment and safety measures of the data owner, the data related to his/her dressing, association, foundation or trade union membership as well as his biometric and genetic data could be processed in the situations determined in the laws. 

-The data related to health and sexual life could be processed for the purposes of protecting public health, medical diagnosis, planning health tasks and financing, sustaining and administration of protective medicine, treatment and care processes by the persons, institutions and entities responsible for keeping secret.

b.      Purposes of Sharing Personal Data

In order to share the personal data obtained with a third party individual or entity, it is necessary to take clear consent from the concerned data owner in this regard. However according to article 8 of the Law of Protection of the Personal Data, data transfer could be provided under conditions in which data processing is permitted and in this case personal data transfer could be performed if the conditions indicated above in Section 2.II.a are available.

Transfer of personal data to third parties within the homeland or abroad are specially conditioned. Personal data could be transferred to foreign countries provided that the data owner natural person has clear consent or in the case that the data owner natural person does not have clear consent but one or several of the other abovementioned conditions exist; provided that the necessary protection measures are taken in the country to which the relevant data are transferred and in the case that the necessary protection measures are not available in the country to which the relevant data are transferred, provided that the data controller commits the necessary protection together with the data controller in the country to which the data are transferred and permission is taken from the board.

Situations our of Scope

In accordance with article 28 of the Law of Protection of the Personal Data, the legal provisions shall not be applicable in the following situations: 

-Process of the personal data by the natural persons fully within the scope of the activities related to him/her or his/her family members living in the same house provided that they are not given to third parties and the obligations related to data security are respected. 

-Process of the personal data for purposes including research, planning and statistics by anonymizing the same through official statistics.

-Process of the personal data for artistic, historical, literal or scientific purposes or within the scope of freedom of expression, provided not to breach national defense, national security, public security, public order, economic security, confidentiality of private life or personality rights. 

-Process of the personal data within the scope of preventive, protective and intelligence related activities executed by public institutions and entities commissioned and authorized by law for the purpose of providing national defense, national security, public security, public order or economic security. 

Process of the personal data by judicial authorities or execution departments with respect to the transactions of prosecution, judgment or execution.

IV. Deletion of Personal Data

Upon expiration of the legal periods of preservation, completion of the judgment processes or when the other requirements are eliminated; those data are deleted, destroyed or anonymized by our company either automatically or upon the concerned person’s request.

The data available within Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi are normally processed as declared by the concerned persons. Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi does not have to investigate the accuracy of the data declared by the customers or the persons contacting Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi and this could not be performed legally and due to our working principles. The data declared are deemed to be accurate. The principle of accuracy and actuality of the personal data has been adopted by Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi as well. Our company updates the personal data processed, on the basis of the official documents delivered or upon the concerned person’s request. It takes the measures necessary for this purpose.

V. Confidentiality and Data Security

Personal data are confidential and Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi respects this confidentiality as well. Only the authorized persons within the company could access personal data. All necessary technical and administrative measures are taken for protecting the personal data collected by Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi and preventing unauthorized persons to obtain those data and preventing our customers and candidate customers to be aggrieved. Within this framework, it is provided that the softwares conform to the standards, third parties are selected attentively and the data protection policy is respected within the company.

VI. Purposes of Data Processing

Collection and process of the personal data by Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi shall be performed for the purposes indicated in the clarification text. The data are collected and processed for the purpose of establishment of the contract or provision of better service to the customers.

Our company processes the personal data within the abovementioned scope for the following purposes:

-Planning, inspecting and execution of the data security processes,

-Creation and application of the data technologies infrastructure,

-Planning and performance of the right and advantage provision activities of the employees,

-Planning and/or performance of the activities of corporate communication for employees and/or the social responsibility activities that the employees participate and/or the activities of nongovernmental organizations,

-Auditing, planning and performance of the authorizations of the employees for access to data,

-Inspecting and tracking the business activities of the employees,

-Tracking the finance and/or accounting works,

-Tracking the law, litigation and execution processes,

-Planning and tracking human resources processes,

-Planning and/or performance of the processes of examination of effectiveness/efficiency and/or appropriateness of the works,

-Planning and performance of the authorization of the business partners and/or suppliers to access data,

-Management of the relationships with the business partners and/or suppliers,

-Planning and/or performance of the processes of occupational health and/or safety,

-Planning and/or performance of the activities of business continuity,

-Planning and performance of the corporate communication activities,

-Planning and performance of the corporate management activities,

-Planning and performance of the logistic activities,

-Planning and performance of the processes of customer relations management,

-Planning and/or performance of the customer satisfaction activities,

-Tracking customer demands and complaints,

-Execution of personnel provision processes,

-Fulfillment of the obligations arising from the service contract and/or legislation for the company employees,

-Planning and performance of the company audit activities,

-Planning and performance of the non-corporate training activities,

-Planning and performance of the operational activities necessary for provision of execution of the company activities in conformity with the company procedures and/or legal legislation,

-Planning and/or performance of the corporate training activities,

-Provision of security of the company operations,

-Provision of security of the head office, branches and warehouses of the company,

-Planning and/or performance of the processes of creation and/or increase of loyalty to the products and/or services offered by the company,

-Planning and performance of the production and/or operational risk processes of the Company,

-Realization of the transactions of companies and partnership law,

-Tracking the contract processes and/or legal claims,

-Performance of the strategic planning activities,

-Planning and performance of the supply chain management processes,

-Wage management,

-Planning and performance of the production and/or operation processes,

-Planning and performance of the activities of market research for marketing and sale of the products and services,

-Planning and performance of the processes of marketing of the products and/or services,

-Planning and performance of the product and/or service sales processes,

-Providing that the data are correct and actual,

-Providing information arising from legislation to the authorized institutions,

-Creation and tracking of visitor registrations.

VII. Categorization of the Personal Data Processed by Our Company

The personal data processed by our company and their categories are as follows:

VIII. Data of customers, potential customers and business and solution partners

Collection and processing of the data for the contractual relation

If any contractual relation is established with our customers and potential customers, the personal data collected could be used without the customer’s approval. However this usage is realized on the basis of the contract purpose. The data are used to the extent necessary for better performance of the contract and the requirements of the service and updated by contacting the customers if necessary. Nonetheless the data that our customer candidates (potential customers) deliver to us are processed for the purpose of offering them easier and higher quality service to them subsequently. Those data are deleted upon request is no contractual relation is established.

Data of Business and Solution Partners

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi adopts it as a principle to act in conformity with the law while sharing data with both the business partners and solution partners. Data are shared with the business partners and solution partners under data confidentiality commitment and only to the extent required by the service and those parties are definitely made take the measures for data security.

Processing Data for Advertising Purposes

Electronic messages with advertising purposes could be sent only to the persons whose prior approval is received in conformity with the Law on Regulation of the E-Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. Definite existence of the approval of the person to whom the advertisement would be sent is a must. Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi respects the details of the “approval” determined again in accordance with the same legislation.

The data transactions performed since it is legal obligation of the company or is clearly stipulated in the law

Personal data could be processed without receiving a separate approval in the case the processing is indicated in the legislation or if it is performed for the purpose of fulfilling a legal obligation determined in the legislation. The types and scopes of data transactions should be necessary for the legally permitted data processing activity and should conform to the relevant legal provisions.

Data Processing by the Company

Personal data could be processed for the services that the company offers and its legitimate objectives. However the data could never be used for illegal services.

Processing the Sensitive Data

According to the law, the data of persons related to their race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, dressing, foundation or trade union membership, health, sexual life, sentence to punishment and safety measures and their biometric and genetic data are sensitive personal data. Additionally Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi takes sufficient measures further determined by the Board in processing of the sensitive personal data.

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi could process the sensitive personal data only for the purpose of collecting such data in order to provide the services better.

Data Obtained through Membership Transactions

In the case that you are a member of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi, your personal data that your share with us for membership transaction are processed in our systems. If you become a member of our system by means of Facebook, Google or any other social media tools; your data that the relevant social media tool provides to the partners including your name, surname, profile picture and e-mail address are accessed and such information is transferred to the systems of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi.

Data Processed Using Automatic Systems

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi acts in conformity with the law with respect to the data processed using automatic systems. The information obtained from those data without clear consent of persons cannot be used against the person. However Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi can take decisions related to the persons for whom it shall perform transaction using the data in its own system.

Functional and Analytical Cookies contain the data for reminding your preferences, for effective use of the internet site, for optimizing the site in the manner to respond the user demands and data about how the visitors use the site. Such cookies could contain your personal data including user name etc. by nature.

Third Party Cookies

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi internet sites/mobile applications /mobile internet sites work with reliable and recognized third party advertisement providers. Third party service providers place their own cookies in order to offer you customized advertisements. The cookies placed by third parties collect and process the information of navigation of the visitors in the internet sites and analyze how they are used.

Commercial Cookies

They are used for offering the products/contents similar to those your target at on the basis of your interests and selections and increasing your usage experience by offering more developed and customized advertisement portfolio. The period of keeping the abovementioned session, permanent, functional, analytical and commercial cookies in the background is approximately 2 (two) months and the person can perform the necessary settings using the internet browser settings. This transaction of removal from settings could vary on the basis of internet browser.

How can I delete the cookies?

Many internet browsers are set for accepting and using the cookies automatically from their first installation in your computer. You can provide prevention of cookies or giving alert when any cookie is sent to your device, using the help or settings menus of your internet browser. You can use the instruction or help options screen of your browser in order to be informed about different ways of managing cookies and to receive detailed information about how you can regulate the settings of the browser that you use.

IX. Data of our employees

Processing the data for business relation

The personal data of our employees could be processed without receiving approval to the extent it is necessary for business relation and health insurance. However Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi provides confidentiality and protection of the data of its employees.

Processing as Required by the Legal Obligations

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi could process the data of its employees without receiving further approval if the processing is clearly stated in the legislation or for the purpose of fulfilling a legal obligation determined by the legislation. This issue is limited to the obligations arising from the law.

Processing to the Benefit of the Employees

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi could process the personal data without receiving approval for transactions to the benefit of the company employees such as private health insurances. Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi could process the data of its employees for the disputes arising from business relationships.

Processing Sensitive Data

According to the law, the data of persons related to their race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, dressing, foundation or trade union membership, health, sexual life, sentence to punishment and safety measures and their biometric and genetic data are sensitive personal data. Furthermore Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi takes sufficient measures determined by the Board for processing sensitive personal data in addition to the approval of the concerned person. The sensitive personal data could be processed without the approval of the concerned person only with respect and limited to the situations permitted in the Law. The sensitive data received from our employees in order to have them benefit from insurance and health services could only be used by allocating them to the purpose.

Data Processed Using Automatic Systems

The data related to the employees processed using automatic systems could be used for corporate promotions and performance assessments. Our employees are entitled to object to any result to their disadvantage and realize this respecting the corporate procedures. The objections of the employees are assessed within the company too.

Telecommunication and Internet

The computers, telephones, e-mails and other applications allocated to the employees within the company have been allocated only for business purposes. The employee cannot use any of those means that the company allocates to him/her for his/her private objectives and communications. The company can control and audit all data on those devices. The employee undertakes that he/she will not keep any non-business data or information in the computer, telephones or other devices allocated to him/her from the moment of recruitment.

X. Transfer of the personal data to the homeland and abroad

Personal data could be shared by Bilgisayar Ticaret Ve Sanayi Anonim Şirketi with the business and solution partners and the affiliates of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi for the purpose of providing the service.

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi can transfer personal data for specific purposes to the following persons and institutions;

·         To the business partners of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi for the purpose of providing fulfillment of the objectives of establishment of the business partnership,

·         To the suppliers of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi as limited to the purpose of enabling the provision of the services which our company outsources from the supplier and which are necessary for fulfillment of the commercial activities of our company,

·         To the solution partners of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi as limited to enabling execution of the commercial activities requiring participation of the affiliates of our company,

·         To the affiliates of Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi.

·         Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi is authorized to transfer the personal data within the conditions determined in the law by the Board, in conformity with other conditions mentioned in the Law and depending on the approval of the person.

XI. Rights of the Concerned Person

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi agrees that the concerned person is entitled within the scope of the Law to be received his/her approval prior to data processing and to determine the destiny of his/her data after data processing.

With respect to the personal data, he/she is entitled by referring to our concerned person announced by Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi in our web page to;

a)      Learn whether the personal data are processed or not,

b)      If the personal data are processed, to request for information in this regard,

c)      Learn the purpose of processing the personal data and whether these are used for the intended purpose or not,

d)      Know the third parties to whom personal data are transferred within the homeland or abroad,

e)      In the case that the personal data are processed incompletely or falsely, to request for correction of these,

f)       To request for deletion or destruction of the personal data under the conditions stipulated in article 7,

g)      To request for notification of the transactions performed in accordance with subparagraphs (d) and (e) to third parties to whom the personal data are transferred,

h)      To object to any result to the disadvantage of the person by analyzing the data processed exclusively by means of automatic systems,

i)       To request for compensation of the loss in the case that he/she incurs loss due to illegal processing of the personal data.

j)       Nonetheless, the persons do not have any right with respect to the data anonymized within the company. Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi can share the personal data with the relevant institutions and entities as required by the business and contractual relation, for the purpose of fulfilling a judiciary task or exercise of the legal authorizations by the state authority.

The natural persons whose data are processed can use the Application Form published in our web site in order to exercise the abovementioned rights.

The applications could be realized by delivering a copy of the form with wet-ink signature together with the documents that will allow identification of the concerned data owner natural person personally or by means of notary public or using other methods indicated in the legislation to the address of Ayazağa Mh, Kemerburgaz Cad. Vadi Koru No:10 F Blok Kat:7 Sarıyer/Istanbul or per registered e-mail by sending the same as signed with secure electronic signature in accordance with the Law of Electronic Signature #5070 to the address of [email protected] or per e-mail from an e-mail address notified in advance to our Company or the e-mail address of our Company. The applications could be delivered by any other method as well in the case such method is determined by the Board of Protection of Personal Data.

Your requests are assessed and replied within maximum thirty days from delivery of your request using the abovementioned methods. Within this scope the right of our company to request from the applicant for additional information and documents for the purpose of assessing and detecting whether the applicant natural person is the concerned data owner or not is reserved. The applications are normally assessed by our company free of charge. However if the board detects any fee for the application of the data owner, our company shall be entitled to request for fee over this detected amount.

.XII. Principle of Confidentiality

The data of both employees and other persons in Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi are confidential. Nobody could use, copy, reproduce those data without compliance with the contract or the law for any other purpose, these data cannot be transferred to others or used for any purpose other than the business purposes.

XIII. Transaction Security

All necessary technical and administrative measures are taken by Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi in order to protect the personal data collected and to prevent them to be captured by unauthorized persons and to prevent our customers and customer candidates to be aggrieved. Within this scope, it is provided that the software conforms to the standards, third parties are selected attentively and the policy of data protection is respected within the company. The measures with respect to security are continuously renewed and developed.

XIV. Audit

Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi has the necessary internal and external audits for protection of the personal data performed.

XV. Notification of Breaches

When Boğaziçi Bilgisayar Ticaret Ve Sanayi Anonim Şirketi is notified that there is breach with respect to the personal data, it promptly takes action to remedy the breach in question. It minimizes the loss of the concerned person and compensates the loss. When the personal data are captured from outside by unauthorized persons, it promptly reports the issue to the Board of Protection of Personal Data.

Applications with respect to notification of breaches could be made in accordance with the procedures indicated in the address of https://www.bogazici.com.tr as well.