Privacy Policy

This English text is a translation provided for convenience. Law No. 6698 on the Protection of Personal Data is Turkish legislation and the Turkish original of this notice prevails in the event of any discrepancy.

At SDF Endüstri we know the value of your data and run all our processes to high security standards.

Purpose

This Privacy Policy explains the methods by which and the legal grounds on which SDF ENDÜSTRİ DIŞ TİCARET VE LOJİSTİK LİMİTED ŞİRKETİ collects personal data, which groups of persons have their personal data processed, which categories of personal data and which example data types are processed in relation to those groups, in which business processes and for which purposes this personal data is used, the technical and administrative measures taken to ensure the security of personal data, to whom and for what purposes personal data may be transferred, the retention periods for personal data, what rights Data Subjects have over their personal data and how they may exercise those rights, and the sharing of personal data with official authorities.

Scope and Amendment

This Policy has been prepared for, and will be applied in respect of, Company Shareholders, Company Business Partners, Company Officers, Job Candidates, Visitors, Company Customers, Potential Customers and Third Parties, provided they are natural persons. By publishing this Policy on its website, the Company informs these Data Subjects about the Law. This Policy has been prepared by our Company in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”).

This Policy applies where our Company processes the Personal Data of the persons referred to above wholly or partly by automated means, or by non-automated means provided the data forms part of a data recording system. Where the data does not fall within the scope of “Personal Data” as described below, or where the processing activity carried out by our Company is not by the means stated above, this Policy will not apply.

Data obtained from you with your consent or on another ground of lawfulness set out in the Law will be used to improve the quality of the services we provide and to develop our quality policy. Some of the data we hold is also stripped of its personal character and anonymised. Such data is used for statistical purposes and is not subject to the application of the Law or to this Policy.

Our Company reserves the right to amend this Policy and our Directive on Personal Data, on condition that such amendment complies with the Law and better protects personal data.

Basic Rules on the Processing of Personal Data

SDF ENDÜSTRİ DIŞ TİCARET VE LOJİSTİK LİMİTED ŞİRKETİ processes personal data in accordance with the procedures and principles laid down in the KVKK and other relevant legislation. In this context, the following principles set out in the KVKK are observed when personal data is processed:

Compliance with the law and the rules of good faith: SDF Endüstri questions the source of the data it collects or receives from other companies and attaches importance to it being obtained lawfully and in accordance with the rules of good faith.

Being accurate and, where necessary, up to date: SDF Endüstri attaches importance to all data held within the organisation being accurate and free of incorrect information, and to updating personal data where a change is notified to it.

Processing for specified, explicit and legitimate purposes: SDF Endüstri processes data only for the purposes for which it has obtained the individual's consent during the provision of its service. It does not process, use or allow the use of data for purposes outside the business purpose.

Being relevant, limited and proportionate to the purposes of processing: SDF Endüstri uses data only in a manner limited to the purposes of processing and to the extent required by the service.

Retention for the period laid down in the relevant legislation or required by the purpose of processing: SDF Endüstri retains data arising from contracts for as long as required by statutory limitation periods for disputes and by the requirements of commercial and tax law. Once those purposes cease to exist, it erases or anonymises the data. It erases or destroys such data in accordance with its Directive on the Erasure of Personal Data.

Principle of Maximum Economy (Data Minimisation)

Under this principle, data reaching SDF Endüstri is entered into the system only to the extent necessary. The data we will collect is therefore determined according to purpose. Data that is not necessary is not collected. Other data reaching our Company is transferred to the company information systems in the same way. Superfluous information is not recorded in the system; it is deleted or anonymised. Such data may be used for statistical purposes.

Erasure of Personal Data

SDF Endüstri retains the personal data it collects for the periods prescribed by the relevant laws and/or the periods required by the purpose of processing, pursuant to Articles 7 and 17 of the KVKK and Article 138 of the Turkish Penal Code. Upon expiry of these periods it will erase, destroy or anonymise the data in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

SDF Endüstri sets out in detail the methods of erasure, destruction and anonymisation and the technical and administrative measures it takes within the scope of its Policy on the Retention and Destruction of Personal Data.

Accuracy and Currency of Data

As a rule, data held by SDF Endüstri is processed as declared by the data subjects concerned. SDF Endüstri is not obliged to investigate the accuracy of data declared by customers or by persons who contact SDF Endüstri, and does not do so, both as a matter of law and because of our working principles. Declared data is accepted as accurate. The principle of accuracy and currency of personal data is nevertheless adopted by SDF Endüstri. Our Company updates the personal data it has processed on the basis of official documents reaching it or at the request of the person concerned, and takes the necessary measures to that end.

Confidentiality and Data Security

Personal data is confidential and SDF Endüstri observes that confidentiality. Within the company, personal data can be accessed only by authorised persons. All necessary technical and administrative measures are taken to protect the personal data collected by SDF Endüstri, to prevent it falling into the hands of unauthorised persons and to ensure that the data subject suffers no harm. In this framework we ensure that software complies with standards, that third parties are selected with care and that the Privacy Policy is observed within the company. Companies with which we lawfully share personal data are also required to protect that data.

Purposes of Data Processing

Processing by SDF ENDÜSTRİ DIŞ TİCARET VE LOJİSTİK LİMİTED ŞİRKETİ is carried out for the purposes set out in the Disclosure Notice on the Processing of Personal Data.

Collection and Processing of Data for a Contractual Relationship

Where a contractual relationship has been established with our customers and prospective customers, the personal data collected may be used without obtaining the customer's separate consent. However, such use takes place in line with the purpose of the contract. Data is used to the extent required for better performance of the contract and for the requirements of the service, and is updated where necessary by contacting customers.

Business and Solution Partner Data

SDF Endüstri has adopted the principle of acting lawfully when sharing data with both business and solution partners. Data is shared with business and solution partners under an undertaking of data confidentiality and only to the extent required by the service, and those parties are required to take measures to ensure data security.

Data Processing for Advertising Purposes

Personal data is processed for advertising or market and opinion research only where the purpose for which the information was collected is compatible with those purposes. Data subjects are informed that their information will be used for advertising purposes. Data subjects may decline to provide data notified as being for advertising use, or to consent to its processing. For data processed for advertising purposes, the explicit consent of the data subject is required even if that person is an employee of SDF Endüstri. The data controller may obtain such explicit consent by electronic approval, post, e-mail, SMS or telephone. The use of personal data for advertising purposes without the explicit consent of the data subject is prevented.

Data Processing Carried Out Because of a Legal Obligation of the Company or Where Expressly Provided by Law

Personal data may be processed without separate consent where the processing is expressly provided for in the relevant legislation or for the purpose of fulfilling a legal obligation laid down by legislation. The type and scope of data processing must be necessary for the legally permitted processing activity and must comply with the relevant legal provisions.

Personal data may be processed in line with the services offered by the Company and its legitimate purposes. However, data may under no circumstances be used for unlawful services.

Employee Data

The personal data of SDF Endüstri employees may be processed without consent to the extent necessary in respect of employment relationships and health insurance. However, SDF Endüstri ensures the confidentiality and protection of its employees' data.

SDF Endüstri may process its employees' personal data without separate consent where the processing is expressly provided for in the relevant legislation or for the purpose of fulfilling a legal obligation laid down by legislation. This is limited to obligations arising from law.

SDF Endüstri may process personal data without consent for transactions that are in the interest of company employees, such as private health insurance. SDF Endüstri may also process employee data in connection with disputes arising from employment relationships.

Transfer of Personal Data Within Türkiye and Abroad

Personal data may be transferred within Türkiye and abroad in accordance with Articles 8 and 9 of the KVKK, on the basis of the explicit consent of the data subject or of the conditions set out in the Law, and provided that the necessary technical and administrative measures are taken.

Rights of the Data Subject Listed in Article 11 of the KVKK

Data subjects have the right to learn whether their personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties in Türkiye or abroad to whom the data is transferred; to request correction of incomplete or incorrectly processed data; to request erasure or destruction of the data where the grounds for processing have ceased to exist; to request that such correction, erasure or destruction be notified to the third parties to whom the data has been transferred; to object to a result arising against them as a consequence of analysis exclusively by automated systems; and to claim compensation for damage suffered as a result of unlawful processing.

Principle of Confidentiality

Persons who process personal data within the Company may not disclose that data to unauthorised persons contrary to the provisions of the Law, and may not use it for purposes other than processing. This obligation continues after they leave their post.

Transaction Security

The Company takes the necessary technical and administrative measures to ensure the security of personal data, and carries out or has carried out the necessary audits for this purpose.

Notification of Breaches

In the event that personal data is obtained by others through unlawful means, the Company notifies the data subject concerned and the Personal Data Protection Board as soon as possible, in accordance with Article 12 of the KVKK.