Akinon Privacy Policy

1. Scope

1.1 The purpose of this personal data protection policy (“Policy”) is to ensure that Akinon İnternet Yatırım ve Proje Geliştirme Anonim Şirketi (“Akinon”) process personal data in accordance with the applicable personal data protection legislation especially the Personal Data Protection Law No. 6698, related secondary legislation and the European General Data Protection Regulation 2016/679 (GDPR) (“Data Protection Legislation”). For the purpose of the Data Protection Legislation, the following definitions will be taken as the basis:

• Personal Data: Any information relating to an identified or identifiable natural person;
• Processing of Personal Data: Any operation performed on personal data wholly or partly by automated means or non-automated means provided that it is a part of a data filing system; such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making it available for collection, categorization, preventing the use thereof;
• Special Categories of Personal Data: Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data;
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system and Akinon;
• Data Processor: The natural or legal person who processes personal data on behalf of the data controller upon its authorization;
• Data Subject: The natural person, whose personal data are processed;
• Data Filing System: Any recording system used by Akinon in which the Personal Data is structured and processed according to certain criteria;
• Board: The Personal Data Protection Board;
• Authority: The Personal Data Protection Authority;
• Supervisory Authority Concerned: means a supervisory authority that is concerned by the processing of personal data since i) the controller or processor is established on the territory of that supervisory authority; ii) data subjects residing in the territory of that supervisory authority are substantially affected or likely to be substantially affected by the processing, or a complaint has been lodged with that supervisory authority.
• PDPL: The Personal Data Protection Law No. 6698 published in the Official Gazette dated 07.04.2016 and numbered 29677.
• GDPR: EU General Data Protection Regulation numbered 2016/679

1.2 Through this Policy, Akinon aims to inform the Data Subject regarding the personal data processed by Akinon, and the content of the Policy is as follows:

• The content and categories of the Personal Data collected by Akinon; their usage and transfer options;
• The processing means of the Personal Data;
• The protection means of the Personal Data;
• The rights of the Data Subjects;
• The measures are taken regarding the protection of Personal Data.

2. The Principles Regarding The Processing of the Personal Data

2.1 Akinon operates and processes data with the purposes set out in the articles of association registered and announced before the relevant trade registry office.

2.2 Akinon develops web and internet-based commercial projects and software, provides web site, portal electronic commerce site, internet domain name, web space, server services, performs all kinds of research and development activities, statistical data analysis, data and information production to be used with the software.

2.3 Akinon, regarding its purposes, processes the Personal Data enumerated below collected from its board members, employees, employee candidates, website visitors, newsletter subscribers, event and training participants, suppliers, authorized persons of the clients and solution partners, their employees and the end-users (“Data Subject”), within the scope of the Data Protection Legislation. (The Personal Data enumerated below may differ pursuant to the Data Subject groups mentioned above.):

• Name surname, ID Number;
• Date of birth, place of birth, mother-father name, civil status, identity data including serial and sequence number of the identification card; identity register copy; certificate of residence;
• Driving license, class of driving license, vehicle registration plate;
• Bank account number,
• Billing and payment information,
• Information on the business/ personal card,
• Social security number,
• Health data in the general health report,
• Fingerprint,
• Passport photograph,
• Contact data including address, phone number, e-mail address,
• Name and surname of the dependents of employees,
• Workplace entry-exit records of the employees,
• Employee’s registration number,
• Information regarding the military service/ compulsory service; education and foreign language/copies of professional certificates, criminal records regarding criminal convictions and security measures,
• Access records of Wi-Fi users of Akinon and IP Address; username and password,
• Location information,
• Information on how the website, extension, and social media content is used,
• Name and surname and contact data of Data Subject’s emergency person,
• Signature of Data Subject,
• Circular of signature or any document confirming the signature,
• Photographs and video records,
• Association/union membership information of the employee candidate;

2.4 Method, Legal Grounds and Purpose of the Personal Data Processing Within the Scope of the Law

Akinon, processes the Personal Data enumerated above within the commercial or employment relationship with the Data Subjects on the grounds that i) it is expressly provided for by the laws and it is imperative to Akinon to perform its legal obligation, ii) processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, iii) it is obligatory for the establishment, exercise or protection of any right, iv) processing of personal data is necessary for the legitimate interests of Akinon, provided that the processing shall not violate the fundamental rights and freedoms of the Data Subjects or v) upon the explicit consent of Data Subjects.

Personal Data processing activities are conducted by Akinon; physically and/or electronically by automated or non-automated means, with the following purposes:

• Personal Data collected during employment relationship procedures are processed within the framework of human resources policies and the employment contract with the purposes to conduct, carry out, manage, maintain, evaluate and end employment relationship, maintain and develop efficient employment management, fulfill obligations arisen from the employment contract and/or the legislation, conduct and performance human resources procedures, evaluate performance of the employees, using administration ability, make plans on their career and success, pay their wages and social rights, make social welfare, carry out transactions before other institutions and organizations including the related social security institution, ensure development and education, provide resource and ability, develop organizational culture, provide and maintain occupational safety, providing payroll service, meet the workforce need in the future through the personnel candidate pool system, obtain information about the job accumulation, experience, professional seniority of the employee candidate and determine the positions and rights in past work experiences, implement the workplace rules, allocate employees a computer, mobile phone, e-mail address, username and password for work purposes, inspect, examine and follow-up the allocated resources.
• Personal Data collected during customer relationship procedures are processed with the purposes to conduct operational and advertisement/promotion procedures, to provide customer satisfaction, perform the service agreement, carry out necessary exercises to recommend and promote the products and services offered to the customers by customizing them according to end-users’ likes, usage habits and needs, conduct evaluation and feedback procedures regarding the services, conduct sales and marketing policies, implementing Akinon Cookies Policies, fulfill legal obligations, provide cloud service, categorizing the customer list by profiling, carry out purchasing activities, organize meetings, resolve commercial disputes and execute communication activities.
• Personal Data collected during supplier relationship procedures are processed for purposes to conduct operational and commercial activities and execute communication activities. Personal Data collected during this procedure are processed during the execution and continuation of the contract with the purpose to fulfill obligations arising from the contractual relationship.
• Personal Data collected during events or trainings are processed with the purposes to provide security, to share or post on social media platforms and to record the training and events attended.
• Personal Data collected during the visit to Akinon website are processed to ensure that the website, platforms and other online services are working correctly, to ensure security, to facilitate navigation, to display information more effectively, to personalize the experience, to improve the design and functionality of the services, to understand how they are used, to monitor website performance, and to track the effectiveness of the online marketing activities.
• Personal Data collected during opt-in newsletter subscription are processed to verify the Data Subjects’ contact information and to provide newsletter service.

Akinon’s purposes of processing and transfer of Data Subject’s Personal Data are limited with the purposes and bases that are stated above.

3. Cookies

Akinon collects some cookie information during your visit to the website. Cookies are text files containing small amounts of information that are downloaded to your computer or mobile device when a website is visited and allow a site to recognize your device. The data collected through cookies are generally used for the purposes of improving the experience on the website, increasing the performance and efficiency of the website, detecting user habits, security and advertising/marketing.

Cookies can remain on devices for different periods of time; these are defined as persistent and temporary cookies. Temporary cookies expire when the browser is closed, whereas persistent cookies remain after the browser is closed until the Data Subject deletes them and may then be used by the browser when the website is used again (for example, to recall login details). Cookies only contain data relating to the website visit and do not collect any information about the data already on the Data Subject’s computer or mobile device.

In certain cases, we collect certain personal data through cookies, including IP address, information about how the website is used, internet browser selection, where the website is accessed from (location information) and which device is used. We use the aforementioned personal data that we process through cookies to maintain the basic functions of our website, to facilitate navigation and improve customer experience and for security purposes. In addition, cookies help us collect statistical information about the use of the services to monitor the effectiveness of our online marketing activities and to understand your website usage habits, tastes and preferences and to provide you with advertisements that may be of interest to you.

In this context, we process the following types of cookies. Preferences for the use of these cookies can be changed at any time. On the other hand, disabling mandatory and functional cookies may result in the loss of the facilities provided by our website and some usage functions.

By clicking on the cookie preferences tab on the Akinon website, you can choose to reject or block all or certain types of cookies set as a result of website visit.

4. Method of Data Collection

Akinon collects Personal Data through the following methods:

• Electronic mail;
• Phone;
• SMS;
• Mail, Courier;
• Website, social media accounts and the other platforms of Akinon,
• Delivery by hand;
• Contracts, employment application form, job advance request form, leave request form, statements of explicit consent, commitments;
• Camera, security cameras.

5. Processing and Transfer of Personal Data

5.1 Processing and Transfer Within the Country

Akinon may process the Personal Data within Turkey and transfer the Personal Data to third natural or legal persons without the need for the explicit consent of the Data Subject under the following conditions:

• It is expressly provided for by the laws;
• It is compulsory for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid;
• Processing of Personal Data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract;
• It is compulsory for compliance with a legal obligation to which Akinon is subject;
• Personal Data have been made public by the data subject himself/herself;
• Data processing is compulsory for the establishment, exercise or protection of any right;
• Processing of data is compulsory for the legitimate interests pursued by Akinon and/or other Data Controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

5.2 Processing and Transfer of Special Categories of Personal Data

• Akinon may process and transfer special categories of Personal Data within the country, only with the explicit consent of the Data Subject.
• Personal data, except for the health and sexual life data, may be processed without obtaining the explicit consent of the Data Subject, in the cases provided for by the laws.
• The health and sexual life data may only be processed without obtaining the explicit consent of the Data Subject by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

5.3 Processing and Transfer Abroad

Akinon may process and transfer the Personal Data abroad, only with the explicit consent of the Data Subject. On the other hand, Akinon may transfer the Personal Data abroad without the explicit consent of the Data Subject under the conditions referred to in Article 5.1 and 5.2 of the Policy and if one of the following conditions exist in the foreign country where the Personal Data are to be transferred;

• Adequate protection is provided in the foreign country where the Personal Data are to be transferred;
• In cases where there is not adequate protection, Akinon may transfer the Personal Data upon the written commitment of Akinon and the data controller(s) in the relevant foreign country for adequate protection and upon the authorization of the Board.
• Without prejudice to the provisions of international agreements, in cases where interest of Turkey or the Data Subject will seriously get harmed, Akinon may only transfer the Personal Data abroad upon the authorization of the Board, receiving the opinions of relevant public institutions and organizations.

6. Third Party Solution Partners

Akinon cooperates with the following third-party solution partners to provide Akinon services within the scope of the below-mentioned purposes, provided that the necessary administrative and technical measures are taken in place.

7. Security of Personal Data

7.1 Akinon shall take all kinds of technical and administrative measures to realize the following purposes regarding to provide an appropriate level of security:

• Preventing unlawful processing of the Personal Data;
• Preventing unlawful access to the Personal Data;
• Ensuring protection of the Personal Data.
• Akinon is jointly liable with the Data Processor(s) on taking measures under Article 7.1 of the Policy, in case the processing of personal data is carried out by another natural or legal person on behalf of Akinon.
• Akinon is obliged to carry out the necessary audits, or have them made, in its own institution or organization, in order to ensure the implementation of the provisions of the Data Protection Legislation.
• Akinon and the Data Processor(s) shall not disclose the personal data that they have learned to anyone contrary to the provisions of Data Protection Legislation, neither shall they use such data other than the processing purposes. This obligation shall continue even after the end of their term of office.
• In case the processed data are obtained by others by unlawful means, Akinon shall communicate with the Data Subject and notify the breach to the Supervisory Authority Concerned within 72 hours.

8. Precautions Related to Protection of Personal Data as Accurate and Updated

Akinon protects the Personal as accurate and updated through the following methods:

• Daily backups;
• Firewall;
• Antivirus programs;
• Encryption systems for the access to virtual platforms and restriction on authorizations and keeping access logs;
• Penetration tests;
• Card, key and encrypted access systems to rooms and cabinets;
• Destruction of personal data whose processing purpose has ended;
• Confidentiality agreements, confidentiality commitments signed with employees;
• Data protection addendums and/or standard contractual clauses signed with the third-party solution partners listed above;
• Transfer impact assessments, and additional technical and organizational measures are taken where necessary;
• In-house plans, policies and procedures such as Data Classification Plan, Personal Data Retention and Destruction Policy, Network Usage Policy, Mobile Device Policy, Log Access Policy, Password Creation Policy, Policy for Access to Data Retain Electronically, Back-up Policy, Incident Management Policy, Data Breach Intervention Plan and Application and Complaint Procedure.

9. Data Retention and Destruction

Personal data obtained by Akinon are stored and destroyed in accordance with the Data Protection Legislation and Akinon Personal Data Retention and Disposal Policy, for a period of time stipulated in the relevant legislation or suitable for our processing purposes.

9.1 Reasons for Destruction

Personal data are deleted, destroyed or anonymized at the request of the data owner or ex officio in the following cases:

• The disappearance of the purpose that requires processing or storage,
• The maximum period for keeping personal data has passed and there are no conditions that justify keeping personal data for a longer period of time,
• The company’s approval of the application made by the data subject for the deletion and destruction of his/her personal data within the framework of his/her rights pursuant to Data Protection Legislation,
• In the event that Akinon rejects the request for the deletion, destruction or anonymization of personal data, the response given is insufficient, or the response is not given within the period stipulated in the Data Protection Legislation; the data subject makes a complaint to the Supervisory Authority Concerned and this request is approved by the Supervisory Authority Concerned,
• In cases where the processing of personal data is carried out only on the condition of explicit consent, the data subject withdraws his/her explicit consent,
• Amendment or repeal of the provisions of the relevant legislation, which are the basis for processing.

10. The Rights of the Data Subject

10.1 Data Subject may use the rights listed below by applying to Akinon:

• ascertaining whether any Personal Data is processed or not;
• requesting information related to the processed Personal Data, if processed;
• ascertaining the purpose of processing Personal Data, and whether this data is used in compliance with the(se) purpose(s);
• identifying third parties to whom the Personal Data is transferred within the country or abroad;
• requesting rectification if the Personal Data is processed in an unsatisfactory or incorrect manner;
• requesting erasure or destruction of the Personal Data;
• requesting to send notification of the operations carried out to the third parties to whom the Personal Data had been transferred;
• objecting to the processing of the personal data, exclusively by automatic means, which results to an unfavorable consequence for the Data Subject and
• claiming compensation for the damages due to the unlawful processing of the personal data.

10.2 In order to exercise the rights listed in Article 10.1., the Data Subject shall convey the requests in writing, along with the information that will enable identification, to Akinon through the following means of communication:

• • via e-mail to [email protected]; or
  • via mail to the address “Yıldız Teknik Üniversitesi Davutpaşa Kampüsü Teknopark B2 Blk. 2/417, Esenler, İstanbul”.

11. Amendments to the Personal Data Protection Policy

Akinon may make amendments to this Policy, which are required due to its activities, or which are legally necessary. The amended Policy becomes valid through the publication on the website https://www.akinon.com/